Medium 6.1

SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on...

CVE-2026-120016 First seen on SecPulse Nov 10, 09:42

Original description The description as published by the source.

SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 6.1; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published: Nov 10, 2026
First seen on SecPulse: Nov 10, 09:42
GHSA: GHSA-jw3m-69w7-hwhg
CWE: CWE-79

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Cross-Site Scripting

CWE

CWE-79

All

Sap Se Sap Netweaver Visual Composer

Detection sources

NIST National Vulnerability Database07:11
GitHub Security Advisories (Global)Nov 10, 12:30
CVE.org (CVE Program・cvelistV5)04:43