CVE-2025-0054

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.

• CWE-79

• https://me.sap.com/notes/3526203
• https://url.sap/sapsecuritypatchday

Published

Feb 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0046Incorrect directory permissions could allow a local user to …7
• CVE-2025-0049When a Web User without Create permission on subfolders atte…4.3
• CVE-2025-0050Improper Restriction of Operations within the Bounds of a Me…5.9
• CVE-2025-0051Improper input validation performed during the authenticatio…8.7
• CVE-2025-0052Improper input validation performed during the authenticatio…8.3
• CVE-2025-0053SAP NetWeaver Application Server for ABAP and ABAP Platform …5.3
• CVE-2025-0055SAP GUI for Windows stores user input on the client PC to im…6
• CVE-2025-0056SAP GUI for Java saves user input on the client PC to improv…6
• CVE-2025-0057SAP NetWeaver AS JAVA (User Admin Application) is vulnerable…4.8
• CVE-2025-0058In SAP Business Workflow and SAP Flexible Workflow, an authe…6.5
• CVE-2025-0059Applications based on SAP GUI for HTML in SAP NetWeaver Appl…6
• CVE-2025-0060SAP BusinessObjects Business Intelligence Platform allows an…6.5