CVE-2025-26662 — Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console
The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already…
Published: 2025-05-13 · CVSS: 4.4 · CVSS 3.1
The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This potentially leads to an impact on confidentiality and integrity. Availability is not impacted.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7