VULNERABILITY INTELLIGENCE
CVE-2025-27434
CVSS score8.8 HIGH
EPSS probability0.45%
CISA KEVNot currently listed
Published2025-03-11
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce.
Weakness classification
- cna@sap.com: CWE-79