GCVE-110-NCSC-2026-6

Advisory PublishedCVSS 9.9/10

Vulnetix · Advisory published January 13, 2026

SAP NetWeaver Enterprise Portal is susceptible to Cross-Site Scripting (XSS), enabling attackers to inject malicious scripts through URL parameters, potentially resulting in session theft and content manipulation.

Download JSON Open in Console

Weaknesses (CWE)

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CWE-94Improper Control of Generation of Code ('Code Injection')CWE-306Missing Authentication for Critical FunctionCWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-862Missing AuthorizationCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-601URL Redirection to Untrusted Site ('Open Redirect')CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereCWE-352Cross-Site Request Forgery (CSRF)CWE-943Improper Neutralization of Special Elements in Data Query LogicCWE-326Inadequate Encryption Strength

Risk Scores

CVSS 3.1

9.9/10

Critical · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
SAP	vers:unknown/*	—	—

Aliases

CVE-2026-0491 CVE-2026-0492 CVE-2026-0493 CVE-2026-0494 CVE-2026-0497 CVE-2026-0498 CVE-2026-0499 CVE-2026-0500 CVE-2026-0501 CVE-2026-0503 CVE-2026-0504 CVE-2026-0506 CVE-2026-0507 CVE-2026-0510 CVE-2026-0511 CVE-2026-0513 CVE-2026-0514

References

advisory

Browse GCVE Records

73,443 records in the GCVE database · Updated July 18, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON