The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to attacker-controlled websites, leading to a low impact on confidentiality and integrity, and no impact on the availability of the application.
References
| Link | Resource |
|---|---|
| https://me.sap.com/notes/3678417 | Permissions Required |
| https://url.sap/sapsecuritypatchday | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
17 Feb 2026, 16:06
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:sap:document_management_system:605:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:602:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:108:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:105:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:107:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:102:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:103:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:603:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:606:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:106:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:617:*:*:*:*:*:*:* cpe:2.3:a:sap:s4core:104:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:604:*:*:*:*:*:*:* cpe:2.3:a:sap:erp:618:*:*:*:*:*:*:* cpe:2.3:a:sap:document_management_system:600:*:*:*:*:*:*:* |
|
| Summary |
|
|
| References | () https://me.sap.com/notes/3678417 - Permissions Required | |
| References | () https://url.sap/sapsecuritypatchday - Vendor Advisory | |
| First Time |
Sap document Management System
Sap s4core Sap Sap erp |
10 Feb 2026, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-10 04:16
Updated : 2026-02-17 16:06
NVD link : CVE-2026-0505
Mitre link : CVE-2026-0505
CVE.ORG link : CVE-2026-0505
JSON object : View
Products Affected
sap
- document_management_system
- erp
- s4core
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')