Sap Se Sap Fiori vulnerabilities

CVE-2020-6283 [MEDIUM] CWE-79 CVE-2020-6283: SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the atta SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting (XSS) vulnerability. With a successful attack, the attacker can steal authentication information of the user, such as data rel

CVE-2026-24315 [MEDIUM] CWE-35 CVE-2026-24315: SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls o SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Avail

CVE-2025-42941 [LOW] CWE-1022 CVE-2025-42941: SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external n SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link () elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary for certain configurations, the attacker does not n