CVE-2025-42872 - Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal · CoreCVE

Back Back to CVE browser

MEDIUM

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Published Dec 9, 2025

6.1

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result, the vulnerability has a low impact on confidentiality and integrity and no impact on availability.

Affected products

Vendor SAP SE Product SAP NetWeaver Enterprise Portal Default
unaffected
Affected
- EP-RUNTIME 7.50

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
SAP SE	SAP NetWeaver Enterprise Portal	unaffected	Affected EP-RUNTIME 7.50

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-489

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201855		Advisory
https://me.sap.com/notes/3662622
https://url.sap/sapsecuritypatchday

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sap

Published Dec 9, 2025

Updated Dec 9, 2025

Reserved Apr 16, 2025

Link CVE-2025-42872

CISA Vulnrichment

Updated Dec 9, 2025

NVD

Status Deferred

Modified Oct 7, 2026

Link CVE-2025-42872

Red Hat

No data

ENISA EUVD

Assigner sap

Published Dec 9, 2025

Updated Dec 9, 2025

Link EUVD-2025-201855

GitHub

No data