Medium severity4.8NVD Advisory· Published Feb 10, 2026· Updated Jun 17, 2026
CVE-2026-24325
CVE-2026-24325
Description
SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an admin user to inject malicious JavaScript into a website and the injected script gets executed when the user visits the compromised page.This vulnerability has low impact on confidentiality and integrity of the data. There is no impact on the availability of the application.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5cpe:2.3:a:sap:businessobjects_enterprise:2025:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:sap:businessobjects_enterprise:2025:*:*:*:*:*:*:*
- cpe:2.3:a:sap:businessobjects_enterprise:2027:*:*:*:*:*:*:*
- cpe:2.3:a:sap:businessobjects_enterprise:430:*:*:*:*:*:*:*
- Range: ENTERPRISE 430
Patches
Vulnerability mechanics
References
2- url.sap/sapsecuritypatchdaynvdVendor Advisory
- me.sap.com/notes/3697256nvdPermissions Required
News mentions
0No linked articles in our index yet.