CVE-2026-109810 CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)

SAP NetWeaver Application Server Java Web Dynpro Java does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser...

CVE-2026-109810: SAP_SE SAP NetWeaver Application Server Java (Web Dynpro Java): SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used…

SAP NetWeaver Application Server Java Web Dynpro Java does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser...