CVE-2025-42945: SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a…

PriorityP430medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.19%

8.6th percentile

SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability could lead to limited access to data or its manipulation. There is no impact on availability.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
sap_se	sap_netweaver_application_server_abap	—	—
sap_se	sap_netweaver_application_server_abap	—	—
sap_se	sap_netweaver_application_server_abap	—	—
sap_se	sap_netweaver_application_server_abap	—	—
sap_se	sap_netweaver_application_server_abap	—	—
sap_se	sap_netweaver_application_server_abap	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.