MEDIUM 6.1 NVD

CVE-2026-120016

SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft

SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability.

References

https://me.sap.com/notes/3806484
https://url.sap/sapsecuritypatchday

Published: 2026-11-10 · Source: NVD · Feed updated: 2026-11-10

This medium severity vulnerability with a CVSS score of 6.1 was published on 2026-11-10 via NVD.

vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.