CVE-2026-34258

MediumCVSS 4.7/10Last modified Oct 26, 2026

Description

SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on the integrity and availability of the application.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-451

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 12, 2026
Last modified: Oct 26, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-342598.2Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorization CVE-2026-34264.3The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on CVE-2026-342609.6SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject maliciou CVE-2026-342616.5Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized cal CVE-2026-342624.3Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer CVE-2026-342639.6Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resul CVE-2026-342646.5During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authentic CVE-2026-342659.8SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in me CVE-2026-342666.5Vulnerability in the PeopleSoft Enterprise HCM Absence Management product of Oracle PeopleSoft (component: Absence Management). The suppor CVE-2026-342674.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.CVE-2026-342682.9Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Securit CVE-2026-342696.1Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affect