CVE-2022-35224

SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This attack can be used to non-permanently deface or modify portal content. The execution of script content by a victim registered on the portal could compromise the confidentiality and integrity of victim�s web browser session.

• CWE-79

• https://launchpad.support.sap.com/#/notes/3210779Permissions Required, Vendor Advisory
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory
• https://launchpad.support.sap.com/#/notes/3210779Permissions Required, Vendor Advisory
• https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.htmlVendor Advisory

Published

Jul 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35219The NHI card’s web service component has a stack-based buffe…5.5
• CVE-2022-3522Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-35220Teamplus Pro community discussion function has an ‘allocatio…6.5
• CVE-2022-35221Teamplus Pro community discussion has an ‘allocation of reso…5.4
• CVE-2022-35222HiCOS Citizen verification component has a stack-based buffe…6.8
• CVE-2022-35223EasyUse MailHunter Ultimate’s cookie deserialization functio…9.8
• CVE-2022-35225SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20,…6.1
• CVE-2022-35226SAP Data Services Management allows an attacker to copy the …6.1
• CVE-2022-35227A vulnerability in SAP NW EP (WPC) - versions 7.30, 7.31, 7.…6.1
• CVE-2022-35228SAP BusinessObjects CMC allows an unauthenticated attacker t…8.8
• CVE-2022-35229An authenticated user can create a link with reflected Javas…5.4
• CVE-2022-3523A vulnerability was found in Linux Kernel. It has been class…5.3