What is CVE-2025-42942?

CVE-2025-42942 is a medium-severity vulnerability in SAP Se Netweaver Application Server For Abap, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-08-12.

How severe is CVE-2025-42942?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Is CVE-2025-42942 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in SAP Se Netweaver Application Server For Abap

CVE-2025-42942

SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could access and modify limited information within the scope of victim's browser. This vulnerability has no impact on availability of the application.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (12.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Sap_se Sap Netweaver Application Server For Abap — versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

ARPSyndicate/cve-scores

References

Frequently asked questions

What is CVE-2025-42942?: CVE-2025-42942 is a medium-severity vulnerability in SAP Se Netweaver Application Server For Abap, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2025-08-12.
How severe is CVE-2025-42942?: Medium severity. CVSS v3 base score is 6.1 out of 10.
Is CVE-2025-42942 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.