CVE-2025-0057

SAP NetWeaver AS JAVA (User Admin Application) is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of victim's web browser.

• CWE-434

• https://me.sap.com/notes/3514421
• https://url.sap/sapsecuritypatchday

Published

Jan 14, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-0051Improper input validation performed during the authenticatio…8.7
• CVE-2025-0052Improper input validation performed during the authenticatio…8.3
• CVE-2025-0053SAP NetWeaver Application Server for ABAP and ABAP Platform …5.3
• CVE-2025-0054SAP NetWeaver Application Server Java does not sufficiently …5.4
• CVE-2025-0055SAP GUI for Windows stores user input on the client PC to im…6
• CVE-2025-0056SAP GUI for Java saves user input on the client PC to improv…6
• CVE-2025-0058In SAP Business Workflow and SAP Flexible Workflow, an authe…6.5
• CVE-2025-0059Applications based on SAP GUI for HTML in SAP NetWeaver Appl…6
• CVE-2025-0060SAP BusinessObjects Business Intelligence Platform allows an…6.5
• CVE-2025-0061SAP BusinessObjects Business Intelligence Platform allows an…9.1
• CVE-2025-0062SAP BusinessObjects Business Intelligence Platform allows an…4.7
• CVE-2025-0063SAP NetWeaver AS ABAP and ABAP Platform does not check for a…8.8