SAP BusinessObjects Enterprise fails to properly encode user‑controlled inputs, enabling an administrator to embed malicious JavaScript that is stored and later executed when a visitor loads the compromised page. The attack provides the attacker with the ability to run code in the context of authenticated users who view the affected content; however, the documented impact on data confidentiality and integrity is low and there is no effect on application availability.

SAP BusinessObjects Enterprise (Central Management Console) versions 2025, 2027, and 430 are impacted. No other version or product information is specified.

The vulnerability receives a CVSS score of 4.8, reflecting low severity, and an EPSS score of less than 1%. It is not listed in the CISA known exploded vulnerabilities catalog. Exploitation requires authenticated administrative access to inject and store the script, after which it is delivered to any user who views the altered page; the attack vector is therefore limited to privileged accounts rather than arbitrary unauthenticated users.