CVE-2020-26825

SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. Information maintained in the victim's web browser can be read, modified, and sent to the attacker. The malicious code cannot significantly impact the victim's browser and the victim can easily close the browser tab to terminate it.

• CWE-79

• https://launchpad.support.sap.com/#/notes/2984627Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2984627Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=562725571Vendor Advisory

Published

Nov 13, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2682Vulnerability in the Oracle VM VirtualBox product of Oracle …8.2
• CVE-2020-26820SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.…7.2
• CVE-2020-26821SAP Solution Manager (JAVA stack), version - 7.20, allows an…10
• CVE-2020-26822SAP Solution Manager (JAVA stack), version - 7.20, allows an…10
• CVE-2020-26823SAP Solution Manager (JAVA stack), version - 7.20, allows an…10
• CVE-2020-26824SAP Solution Manager (JAVA stack), version - 7.20, allows an…10
• CVE-2020-26826Process Integration Monitoring of SAP NetWeaver AS JAVA, ver…6.5
• CVE-2020-26828SAP Disclosure Management, version - 10.1, provides capabili…6.4
• CVE-2020-26829SAP NetWeaver AS JAVA (P2P Cluster Communication), versions …10
• CVE-2020-2683Vulnerability in the Oracle FLEXCUBE Universal Banking produ…5.4
• CVE-2020-26830SAP Solution Manager 7.2 (User Experience Monitoring), versi…8.1
• CVE-2020-26831SAP BusinessObjects BI Platform (Crystal Report), versions -…9.6