Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2026-0505— Multiple vulnerabilities in BSP Applications of SAP Document Management System

CVSS 6.1 · Medium EPSS 0.03% · P10
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-0505

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Multiple vulnerabilities in BSP Applications of SAP Document Management System
Source: NVD (National Vulnerability Database)
Vulnerability Description
The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
SAP E-Recruiting BSP 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP E-Recruiting BSP是德国思爱普（SAP）公司的一个招聘流程管理模块。 SAP E-Recruiting BSP存在跨站脚本漏洞，该漏洞源于用户控制的URL参数验证不足，可能导致未经验证的重定向到攻击者控制的网站。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
SAP_SESAP Document Management System SAP_APPL 618 -

II. Public POCs for CVE-2026-0505

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-0505

请登录查看更多情报信息。

Same Patch Batch · SAP_SE · 2026-02-10 · 26 CVEs total

CVE-2026-04889.9 CRITICALCode Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)
CVE-2026-05099.6 CRITICALMissing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
CVE-2026-236878.8 HIGHXML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform
CVE-2026-243227.7 HIGHMissing Authorization check in SAP Solution Tools Plug-In (ST-PI)
CVE-2026-236897.7 HIGHDenial of service (DOS) in SAP Supply Chain Management
CVE-2026-04857.5 HIGHDenial of service (DOS) vulnerability in SAP BusinessObjects BI Platform
CVE-2026-04907.5 HIGHDenial of service (DOS) in SAP BusinessObjects BI Platform
CVE-2026-05087.3 HIGHOpen Redirect vulnerability in SAP BusinessObjects Business Intelligence Platform
CVE-2026-04846.5 MEDIUMMissing Authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA
CVE-2026-243246.5 MEDIUMDenial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platfor
CVE-2026-243286.1 MEDIUMOpen Redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)
CVE-2026-243236.1 MEDIUMMultiple vulnerabilities in BSP Applications of SAP Document Management System
CVE-2026-236845.9 MEDIUMRace condition vulnerability in SAP Commerce Cloud
CVE-2026-243195.8 MEDIUMInformation Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files)
CVE-2026-243215.3 MEDIUMInformation Disclosure vulnerability in SAP Commerce Cloud
CVE-2026-243125.2 MEDIUMMissing authorization check in SAP Business Workflow
CVE-2026-04865.0 MEDIUMMissing Authorization Check in ABAP based SAP systems
CVE-2026-243254.8 MEDIUMCross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Manage
CVE-2026-236854.4 MEDIUMInsecure Deserialization vulnerability in SAP NetWeaver (JMS service)
CVE-2026-236884.3 MEDIUMMissing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)

Showing top 20 of 26 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: SAP Document Management System
Same vendor: SAP_SE
Same weakness: CWE-79

V. Comments for CVE-2026-0505

No comments yet

Leave a comment