cbcvebase.
CVE-2025-42942
published 2025-08-12

CVE-2025-42942: SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with…

PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.21%
10.6th percentile
SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could access and modify limited information within the scope of victim's browser. This vulnerability has no impact on availability of the application.

Affected

17 ranges
VendorProductVersion rangeFixed in
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
sap_sesap_netweaver_application_server_for_abap——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.