Log in Start free

Vulnerability · Published Aug 12, 2025 · Assigned by sap

CVE-2025-42945HTML Injection vulnerability in SAP NetWeaver Application Server ABAP

Medium 6.1

In plain English

A medium-severity code injection in SAP NetWeaver Application Server ABAP from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 86.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability could lead to limited access to data or its manipulation. There is no impact on availability.

Affected products (as reported)

VendorProductVersions
SAP_SE SAP NetWeaver Application Server ABAP KRNL64UC 7.53KERNEL 7.537.547.777.897.93

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References