An unauthenticated attacker can manipulate URL parameters in SAPUI5 Search UI to embed malicious content. When a victim user interacts with the modified UI, they are steered to attacker‑controlled pages that the application renders. The vulnerability does not alter data or disrupt application availability; its primary effect is to lower confidentiality by exposing users to phishing or deceptive content.

The affected product is SAPUI5 Search UI, a component of SAP SE’s SAPUI5 framework. No specific version information is available in the current data, so all deployments of the Search UI that have not applied SAP’s recommended update may be vulnerable.

With a CVSS score of 4.7 the flaw is considered low‑severity. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly known exploitation. It can be triggered via simple URL manipulation without authentication, meaning an attacker who can redirect a user’s browser to a crafted link can exploit it. Because the flaw only affects the rendered content and does not alter sensitive data, the overall risk remains moderate, but organizations that rely on SAPUI5 Search UI for user interactions should address it promptly.