CVE-2021-27600

SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in Stored Cross-Site Scripting (XSS) vulnerability. The malicious code can be used for different purposes. e.g., information can be read, modified, and sent to the attacker. However, availability of the server cannot be impacted.

• CWE-79

• https://launchpad.support.sap.com/#/notes/3024414Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3024414Permissions Required
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649Vendor Advisory

Published

Apr 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27594When a user opens manipulated Windows Bitmap (.BMP) files re…3.3
• CVE-2021-27595When a user opens manipulated Portable Document Format (.PDF…3.3
• CVE-2021-27596When a user opens manipulated Autodesk 3D Studio for MS-DOS …3.3
• CVE-2021-27597SAP NetWeaver AS for ABAP (RFC Gateway), versions - KRNL32NU…7.5
• CVE-2021-27598SAP NetWeaver AS JAVA (Customer Usage Provisioning Servlet),…5.3
• CVE-2021-27599SAP NetWeaver ABAP Server and ABAP Platform (Process Integra…6.5
• CVE-2021-27601SAP NetWeaver AS Java (Applications based on HTMLB for Java)…5.4
• CVE-2021-27602SAP Commerce, versions - 1808, 1811, 1905, 2005, 2011, Backo…9.9
• CVE-2021-27603An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWea…6.5
• CVE-2021-27604In order to prevent XML External Entity vulnerability in SAP…6.5
• CVE-2021-27605SAP's HCM Travel Management Fiori Apps V2, version - 608, do…4.3
• CVE-2021-27606SAP NetWeaver ABAP Server and ABAP Platform (Enqueue Server)…7.5