CVE-2025-42872
Medium · 6.1CVSS
6.1
EPSS
0.3%
Published
Dec 9, 2025
CISA due date
—
The record
Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result, the vulnerability has a low impact on confidentiality and integrity and no impact on availability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-6485 UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or… CWE-489
- CVE-2026-77545 A malicious actor with access to the network, low privileges and under certain conditions… CWE-489
- CVE-2026-66403 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. CWE-489
- CVE-2026-66405 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. CWE-489
- CVE-2026-54799 A vulnerability has been identified in CPCI85 Central Processing/Communication (All… CWE-489
- CVE-2026-54798 A vulnerability has been identified in CPCI85 Central Processing/Communication (All… CWE-489
- CVE-2026-59092 JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass… CWE-489
- CVE-2026-49188 The ai_cmd utility executes with full root permissions. CWE-489