{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2025-42938",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-42938",
    "idYear": 2025,
    "status": "PUBLISHED",
    "publishedAt": "2025-09-09T02:11:33.755Z",
    "updatedAt": "2026-10-13T00:18:36.596Z",
    "importedAt": "2026-10-24T01:57:34.152Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform",
      "summary": "Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation, resulting in the creation of malicious content. When executed, this content allows the attacker to access or modify information within the victim's browser scope, impacting the confidentiality and integrity�while availability remains unaffected.",
      "affected": [
        {
          "vendor": "SAP_SE",
          "product": "SAP NetWeaver ABAP Platform",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "S4CRM 100",
              "status": "affected"
            },
            {
              "version": "200",
              "status": "affected"
            },
            {
              "version": "204",
              "status": "affected"
            },
            {
              "version": "205",
              "status": "affected"
            },
            {
              "version": "206",
              "status": "affected"
            },
            {
              "version": "S4CEXT 107",
              "status": "affected"
            },
            {
              "version": "BBPCRM 713",
              "status": "affected"
            },
            {
              "version": "714",
              "status": "affected"
            },
            {
              "version": "S4CEXT 108",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}