CVE-2026-24325

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP_SE	SAP BusinessObjects Enterprise (Central Management Console)	ENTERPRISE 430; 2025; 2027

References

https://me.sap.com/notes/3697256Permissions Required
https://url.sap/sapsecuritypatchdayVendor Advisory

Timeline

Published: Feb 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-243264.3Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges CVE-2026-243274.3Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated at CVE-2026-243286.1SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when clicked by a victim, re CVE-2026-243294.9A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address CVE-2026-24336.1The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to DOM-Based Cross-Site Scrip CVE-2026-243306.5A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file f CVE-2026-243324.3Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because CVE-2026-24346.4The Pz-LinkCard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blogcard' shortcode attributes in all versions up CVE-2026-243438.8Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache H CVE-2026-243447.3Multiple Buffer Overflows in Admin UI of EZCast Pro II version 1.17478.146 allow attackers to cause a program crash and potential remote cod CVE-2026-243458.8Cross-Site Request Forgery in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to bypass authorization checks and gain full ac CVE-2026-243469.1Use of well-known default credentials in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to access protected areas in the web