Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-43006: SAP Supplier Relationship Management allows malicious scripts to run on the application

CVE-2025-43006 · published 1 year ago

Summary

An attacker can run unauthorized scripts in the SAP Supplier Relationship Management application without needing a password. This could allow them to steal sensitive information or disrupt the application's operation. Update the application to the latest version to fix this issue.

Original advisory text

SAP Supplier Relationship Management (Master Data Management Catalogue) allows an unauthenticated attacker to execute malicious scripts in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published13 May 2025

Updated3 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-43006 · NVD

Track software like this

Free during beta