Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-89106

Cross Site Scripting (XSS) vulnerability in SAPUI5

SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availability.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sapui5
CVE-2026-76975

Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)

Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper sanitization, causing attacker-supplied script to execute in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sapui5 (support Assistant Overlay)
CVE-2026-76977

Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist. An unauthenticated attacker could host a malicious page to bypass framing restrictions. If an authenticated victim visits the attacker's page and interacts with it, the attacker could trick the victim into performing unintended actions, resulting in a low impact on integrity. There is no impact on confidentiality and availability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sapui5(frame Options Allowlist)
CVE-2026-66771

Cross Site Scripting (XSS) vulnerability in SAPUI5

SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted application, the injected script executes in the victim's browser session. Successful exploitation could allow the attacker to access sensitive session data and perform unauthorized actions on behalf of the victim, resulting in a high impact on confidentiality and integrity. There is no impact on availability.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sapui5
CVE-2026-34258

Content Spoofing vulnerability in SAPUI5 (Search UI)

SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include malicious content. Successful exploitation may mislead victim users into clicking and accessing attacker-controlled pages rendered by the application. This vulnerability has a low impact on confidentiality with no effect on the integrity and availability of the application.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sapui5 (search Ui)
CVE-2024-33007

Client-side script execution vulnerability in SAP UI5(PDFViewer)

PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript (or any harmful client-side script), the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential security threat.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Sap Se
Products
Sapui5
CVE-2025-42873

Denial of Service (DoS) in SAPUI5 framework (Markdown-it component)

SAPUI5 (and OpenUI5) packages use outdated 3rd party libraries with known security vulnerabilities. When markdown-it encounters special malformed input, it fails to terminate properly, resulting in an infinite loop. This Denial of Service via infinite loop causes high CPU usage and system unresponsiveness due to a blocked processing thread. This vulnerability has no impact on confidentiality or integrity but has a high impact on system availability.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
Sapui5 Sapui5