What is CVE-2025-42872?

CVE-2025-42872 is a medium-severity vulnerability in Sap Se Netweaver Enterprise Portal, classified under Active Debug Code. CVSS score: 6.1/10. Published 2025-12-09.

How severe is CVE-2025-42872?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Vulnerability in Sap Se Netweaver Enterprise Portal

CVE-2025-42872

Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result, the vulnerability has a low impact on confidentiality and integrity and no impact on availability.

EPSS: 0.002 (13.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Sap_se Sap Netweaver Enterprise Portal — versions EP-RUNTIME 7.50

Weakness classification (CWE)

CWE-489 — Active Debug Code

References

Frequently asked questions

What is CVE-2025-42872?: CVE-2025-42872 is a medium-severity vulnerability in Sap Se Netweaver Enterprise Portal, classified under Active Debug Code. CVSS score: 6.1/10. Published 2025-12-09.
How severe is CVE-2025-42872?: Medium severity. CVSS v3 base score is 6.1 out of 10.