Riskcovery

CVE-2026-0505

Multiple vulnerabilities in BSP Applications of SAP Document Management System

State
Published
Severity
6.1 Medium
Published
Feb 10, 2026
Updated
Feb 10, 2026
Reserved
Dec 9, 2025

Read the record on cve.org

Description

The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsap

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation

Affected Products

ProductVersions
SAP Document Management SystemSAP_SE
  • SAP_APPL 618Affected
  • S4CORE 102Affected
  • 103Affected
  • 104Affected
  • 105Affected
  • 106Affected
  • 107Affected
  • 108Affected
  • 109Affected
  • EA-APPL 600Affected
  • 602Affected
  • 603Affected
  • 604Affected
  • 605Affected
  • 606Affected
  • 617Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.