VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Feb 10, 2026· Updated Jun 17, 2026

CVE-2026-24323

CVE-2026-24323

Description

The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

17
  • SAP_SE/SAP Document Management Systemv5
    Range: SAP_APPL 618
  • SAP/Document Management System7 versions
    cpe:2.3:a:sap:document_management_system:600:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:sap:document_management_system:600:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:document_management_system:602:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:document_management_system:603:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:document_management_system:604:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:document_management_system:605:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:document_management_system:606:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:document_management_system:617:*:*:*:*:*:*:*
  • SAP/ERP
    cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:*
  • SAP/S4CORE7 versions
    cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:s4core:108:*:*:*:*:*:*:*
  • SAP/BSP applicationsllm-create

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.