CVE-2025-42990 — HTML Injection in Unprotected SAPUI5 applications
Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controll…
Published: 2025-06-10 · CVSS: 3.0 · CVSS 3.1
Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7