What is CVE-2025-0054?

CVE-2025-0054 is a medium-severity vulnerability in Sap Se Netweaver Application Server Java, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-02-11.

How severe is CVE-2025-0054?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Is CVE-2025-0054 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Sap Se Netweaver Application Server Java

CVE-2025-0054

SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (18.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Sap_se Sap Netweaver Application Server Java — versions EP-BASIS 7.50, FRAMEWORK-EXT 7.50

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-0054?: CVE-2025-0054 is a medium-severity vulnerability in Sap Se Netweaver Application Server Java, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-02-11.
How severe is CVE-2025-0054?: Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2025-0054 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.