CVE-2025-42945 MEDIUM

CVE-2025-42945: HTML Injection vulnerability in SAP NetWeaver Application Server ABAP

Vendor Sap_Se
Product SAP NetWeaver Application Server ABAP
Weakness CWE-94 · Code injection
Published August 12, 2025
Last update August 12, 2025
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability could lead to limited access to data or its manipulation. There is no impact on availability.

Key dates

02Disclosure timeline

August 12, 2025 CVE published
August 12, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-48100 WordPress bidorbuy Store Integrator plugin <= 2.12.0 - Remote Code Execution (RCE) vulnerability CVE-2025-15129 ChenJinchuang Lin-CMS-TP5 File Upload LocalUploader.php upload code injection CVE-2026-5584 Fosowl agenticSeek query Endpoint PyInterpreter.py PyInterpreter.execute code injection CVE-2024-13797 PressMart - Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-5683 Remote Code Execution in Next4Biz's BPM