P4Verified

CVE-2025-42901: SAP Application Server for ABAP (BAPI Browser) SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS…

CVE-2025-42901. CVSS 3.1 base score 5.4 (MEDIUM, Vendor/CNA). EPSS 0.00226 (percentile 0.12233), scored 06-Oct-2026.

Affected technology

SAP Application Server for ABAP (BAPI Browser) · SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816
SAP_SE

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker can store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. Vendor/CNA’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.

Published 12-Oct-2026 00:35 UTC

CWE: CWE-94
CCR priority: 21.7 /100 (P4)
CVSS 3.1: 5.4 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · Vendor/CNA
EPSS: 0.00226 · percentile 0.1231 · 2026-10-11
KEV: no

Provenance

FIRST EPSS daily exploit-probability · Source record · observed 2026-10-11 23:42:05.235979+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-08 17:32:11.049884+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2025-42901.html