CVE-2026-44752
published 2026-07-14CVE-2026-44752: SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a…
PriorityP346high8.2CVSS 3.1
AVNACLPRNUIRSCCHILAN
EPSS
0.36%
29.5th percentile
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data displayed in the client�s browser. This results in a high impact on confidentiality, low impact on integrity with no impact on availability of the application.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap_se | sap_netweaver_application_server_java | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SAP NetWeaver Application Server Java LMCTC 7.50 URL injection
vuldb·2026-07-14·CVSS 8.2
CVE-2026-44752 [HIGH] SAP NetWeaver Application Server Java LMCTC 7.50 URL injection
A vulnerability was found in SAP NetWeaver Application Server Java LMCTC 7.50. It has been rated as critical. This issue affects some unknown processing of the component URL Handler. This manipulation of the argument URL causes injection.
This vulnerability is tracked as CVE-2026-44752. The attack is possible to be carried out remotely. No exploit exists.
GHSA
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs.
ghsa_unreviewed·2026-07-14
CVE-2026-44752 [HIGH] CWE-79 SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs.
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data displayed in the client�s browser. This results in a high impact on confidentiality, low impact on integrity with no impact on availability of the application.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-14
Published