Sapui5
Monthly
Stored cross-site scripting in SAPUI5's content adaptation feature allows a key user with content adaptation privileges to inject persistent malicious scripts into adapted application definitions. When any user subsequently opens the compromised adapted application, the injected script executes in their browser session, enabling session token theft and unauthorized actions on behalf of the victim. Affected versions span multiple SAPUI5 release tracks (754 through 816 and SAP_UI 750); no public exploit or CISA KEV listing has been identified at time of analysis.
Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5 control allows injection of untrusted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in SAPUI5's content adaptation feature allows a key user with content adaptation privileges to inject persistent malicious scripts into adapted application definitions. When any user subsequently opens the compromised adapted application, the injected script executes in their browser session, enabling session token theft and unauthorized actions on behalf of the victim. Affected versions span multiple SAPUI5 release tracks (754 through 816 and SAP_UI 750); no public exploit or CISA KEV listing has been identified at time of analysis.
Due to improper neutralization of input in SAPUI5 - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, sap.m.FormattedText SAPUI5 control allows injection of untrusted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.