Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user‑supplied content in certain functionality. An authenticated attacker can embed malicious scripts that, when another user views the content, are executed in that user’s browser context. The vulnerability has only a low impact on data confidentiality and integrity and no impact on application availability, but it allows a victim user to run code in their own session.

SAP NetWeaver Application Server ABAP products that use SAP GUI for HTML are affected. No specific version information is supplied; the vulnerability applies to all installations employing the vulnerable functionality.

The CVSS score of 5.4 indicates a moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated attacker who can send malicious content to a target user, and it relies on the victim interacting with the compromised content. Because the impact is client‑side, the threat is limited to script execution in the browser context, but it can still lead to phishing or credential theft if a user is deceived.