medium6.1
CVE-2026-24323
The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized.
Impact
The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses a crafted URL, the injected script is executed in the victim�s browser, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Document Management System | Versions 600, 602, 603, 604, 605, 606 |
| Sap | Erp | Version 618 |
| Sap | S4core | Versions 102, 103, 104, 105, 106, 107 |