CVE-2021-33665

SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML), versions - KRNL64NUC - 7.49, KRNL64UC - 7.49,7.53, KERNEL - 7.49,7.53,7.77,7.81,7.84, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

• CWE-79

• https://launchpad.support.sap.com/#/notes/3028370Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999Vendor Advisory
• https://launchpad.support.sap.com/#/notes/3028370Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999Vendor Advisory

Published

Jun 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33659SAP 3D Visual Enterprise Viewer, version - 9, allows a user …5.5
• CVE-2021-33660SAP 3D Visual Enterprise Viewer, version - 9, allows a user …5.5
• CVE-2021-33661SAP 3D Visual Enterprise Viewer, version - 9, allows a user …5.5
• CVE-2021-33662Under certain conditions, the installation of SAP Business O…4.4
• CVE-2021-33663SAP NetWeaver AS ABAP, versions - KRNL32NUC - 7.22,7.22EXT, …5.3
• CVE-2021-33664SAP NetWeaver Application Server ABAP (Applications based on…5.4
• CVE-2021-33666When SAP Commerce Cloud version 100, hosts a JavaScript stor…6.1
• CVE-2021-33667Under certain conditions, SAP Business Objects Web Intellige…4.3
• CVE-2021-33668Due to improper input sanitization, specially crafted LDAP q…7.5
• CVE-2021-33669Under certain conditions, SAP Mobile SDK Certificate Provide…7.8
• CVE-2021-33670SAP NetWeaver AS for Java (Http Service Monitoring Filter), …7.5
• CVE-2021-33671SAP NetWeaver Guided Procedures (Administration Workset), ve…8.8