SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability.
References
Configurations
No configuration.
History
22 Sep 2026, 01:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-22 01:16
Updated : 2026-09-22 19:37
NVD link : CVE-2026-76974
Mitre link : CVE-2026-76974
CVE.ORG link : CVE-2026-76974
JSON object : View
Products Affected
No product.
CWE
CWE-95
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')