CVE-2026-24325

published 2026-02-10

CVE-2026-24325: SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an…

Priority P4 22 medium 4.8 CVSS 3.1

AV N AC L PR H UI R S C C L I L A N

SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
sap	businessobjects_enterprise	—	—
sap	businessobjects_enterprise	—	—
sap	businessobjects_enterprise	—	—
sap_se	sap_businessobjects_enterprise	—	—
sap_se	sap_businessobjects_enterprise	—	—
sap_se	sap_businessobjects_enterprise	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79