CVE-2025-42990

3.0 lowEPSS 0.2%

Low (3.0). EPSS 0.2% chance of exploitation in the next 30 days.

Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.

Severity

CVSS 3.1

3.0 low

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-06-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://me.sap.com/notes/3601169
https://url.sap/sapsecuritypatchday

Check your stack JSON