CVE-2025-42886— Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector
Quick assessment
Affected
SAP_SE SAP Business Connector
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SAP Business Connector是德国思爱普（SAP）公司的一种中间件。 SAP Business Connector存在跨站脚本漏洞，该漏洞源于反射型跨站脚本漏洞，可能导致攻击者访问或修改受害者浏览器范围内的信息。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-42886
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector
Source: CVE Program / CVE List V5
Vulnerability Description
Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim's browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
SAP Business Connector 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP Business Connector是德国思爱普（SAP）公司的一种中间件。 SAP Business Connector存在跨站脚本漏洞，该漏洞源于反射型跨站脚本漏洞，可能导致攻击者访问或修改受害者浏览器范围内的信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP Business Connector | SAP BC 4.8 | - |
|
II. Public POCs for CVE-2025-42886
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-42886
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2025-11-11 · 18 CVEs total
| CVE-2025-42890 | 10.0 CRITICAL | Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui) |
| CVE-2025-42887 | 9.9 CRITICAL | Code Injection vulnerability in SAP Solution Manager |
| CVE-2025-42940 | 7.5 HIGH | Memory Corruption vulnerability in SAP CommonCryptoLib |
| CVE-2025-42895 | 6.9 MEDIUM | Code Injection vulnerability in SAP HANA JDBC Client |
| CVE-2025-42894 | 6.8 MEDIUM | Path Traversal vulnerability in SAP Business Connector |
| CVE-2025-42892 | 6.8 MEDIUM | OS Command Injection vulnerability in SAP Business Connector |
| CVE-2025-42884 | 6.5 MEDIUM | JNDI Injection vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2025-42924 | 6.1 MEDIUM | Open Redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP) |
| CVE-2025-42893 | 6.1 MEDIUM | Open Redirect vulnerability in SAP Business Connector |
| CVE-2025-42885 | 5.8 MEDIUM | Missing authentication in SAP HANA 2.0 (hdbrss) |
| CVE-2025-42888 | 5.5 MEDIUM | Information Disclosure vulnerability in SAP GUI for Windows |
| CVE-2025-42889 | 5.4 MEDIUM | SQL Injection vulnerability in SAP Starter Solution (PL SAFT) |
| CVE-2025-42897 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP Business One (SLD) |
| CVE-2025-42919 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Application Server Java |
| CVE-2025-42899 | 4.3 MEDIUM | Missing Authorization check in SAP S4CORE (Manage Journal Entries) |
| CVE-2025-42882 | 4.3 MEDIUM | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2025-42883 | 2.7 LOW | Insecure File Operations vulnerability in SAP NetWeaver Application Server for ABAP (Migra |
IV. Related Vulnerabilities
Same product: SAP Business Connector
-
CVE-2026-0514
Cross-Site Scripting (XSS) vulnerability in SAP Business Con -
CVE-2025-42894
Path Traversal vulnerability in SAP Business Connector -
CVE-2025-42893
Open Redirect vulnerability in SAP Business Connector -
CVE-2025-42892
OS Command Injection vulnerability in SAP Business Connector -
CVE-2024-30215
Cross-Site Scripting (XSS) vulnerability in SAP Business Con
Same vendor: SAP_SE
-
CVE-2026-58231
Improper Authorization in SAP Commerce Cloud (Data Hub Adapt -
CVE-2026-66779
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap -
CVE-2026-66778
Multiple vulnerabilities in SAP Business AI Platform (Approu -
CVE-2026-66777
Multiple vulnerabilities in SAP Business AI Platform (Approu -
CVE-2026-66776
Multiple vulnerabilities in SAP Business AI Platform (Approu
Same weakness: CWE-79
-
CVE-2026-8630
justhtml before 1.12.0 Mutation XSS via Raw Text Elements -
CVE-2026-8445
justhtml before 1.12.0 Sanitizer Bypass via Markdown -
CVE-2026-77088
justhtml 0.9.0 through 1.21.0 Cross-Site Scripting via code- -
CVE-2026-74793
justhtml before 3.11.0 XSS via selectedcontent projection -
CVE-2026-6827
justhtml before 1.17.0 Multiple Cross-Site Scripting Vulnera
V. Comments for CVE-2025-42886
No comments yet