CVE-2025-42973

CVE-2025-42973 affects the SAP Data Services Management Console. A cross-site scripting (XSS) vulnerability exists in the search functionality for DQ job status reports. An authenticated attacker can intercept requests to inject malicious script, which executes when the affected page loads. This ...

CVE-2025-42973 Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report)

Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associated with DQ job status reports. By intercepting requests, malicious script can be injected and subsequently executed when a user loads the...

SAP Data Services Management Console Cross-site Scripting Vulnerability

SAP Data Services Management Console is a centralized management interface for SAP Data Services from SAP, Germany. A cross-site scripting vulnerability exists in SAP Data Services Management Console that originates from cross-site scripting and could affect user session information...

PT-2025-28291 · Sap · Sap Data Services Management Console

Name of the Vulnerable Software and Affected Versions: SAP Data Services Management Console affected versions not specified Description: The issue is related to a Cross-Site Scripting vulnerability in the search functionality associated with DQ job status reports. An authenticated attacker could...

CVE-2025-42973: Improper Neutralization of Input During Web Page Generation

Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associated with DQ job status reports. By intercepting requests, malicious script can be injected and subsequently executed when a user loads the...

CVE-2022-35226

SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immediate response, it will lead to a Cross-Site Scripting vulnerability. The attacker would have to log in to the management console to perform such as an attack, only few of the pag...

CVE-2020-14745

Vulnerability in the Oracle REST Data Services product of Oracle REST Data Services component: General. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c; Standalone ORDS: prior to 20.2.1. Easily exploitable vulnerability allows low privileged attacker with networ...

CVE-2020-14744

Vulnerability in the Oracle REST Data Services product of Oracle REST Data Services component: General. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c and 19c; Standalone ORDS: prior to 20.2.1. Easily exploitable vulnerability allows low privileged attacker with networ...

SAP Data Services Management Console Cross-Site Scripting Vulnerability

SAP Data Services Management Console is a console for managing and monitoring data services. A cross-site scripting vulnerability exists in SAP Data Services Management Console that stems from the system failing to adequately encode user-controlled input. An attacker could exploit the vulnerabili...

CVE-2025-26662

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

CVE-2025-26662

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

CVE-2025-26662 Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

CVE-2025-26662 Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

CVE-2025-26662

CVE-2025-26662 describes a Cross-Site Scripting vulnerability in the SAP Data Services Management Console caused by insufficient encoding of user-controlled input. If a logged-in user clicks a crafted link, injected script executes in the victim’s browser, potentially impacting confidentiality an...

SAP Data Services Management Console Cross-site Scripting Vulnerability

SAP Data Services Management Console is a console for managing and monitoring data services. A cross-site scripting vulnerability exists in SAP Data Services Management Console that stems from the system failing to adequately encode user-controlled input. An attacker could exploit the vulnerabili...

PT-2025-20804 · Sap Se · Sap Data Services Management Console

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns insufficient encoding of user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on a compromised...

CVE-2025-26662: Improper Neutralization of Input During Web Page Generation

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

ZTE GoldenDB Access Control Error Vulnerability

ZTE GoldenDB is a financial-grade transactional distributed database from China's ZTE Corporation ZTE. It is used in finance, government and enterprise, telecom and other industries to provide highly available data services. An Access Control Error vulnerability exists in ZTE GoldenDB, which stem...

Oracle Critical Patch Update, January 2025 Security Update Review

Oracle released its first quarterly edition of this year’s Critical Patch Update, which received patches for 318 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, includin...

Adobe XML External Entity Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Adobe XML External Entity Injection', 'Description' = %q Multiple Adobe Products -- XML External Entity Injection. Affected Software: BlazeDS 3.2...