CVE-2026-109810
CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)
Description
SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser to load attacker-controlled styling content within the trusted application context. Successful exploitation could allow the attacker to redress the trusted user interface for phishing purposes and exfiltrate limited web page content, resulting in a low impact on confidentiality and integrity. There is no impact on availability.
INFO
Published Date :
Nov. 10, 2026, 12:40 a.m.
Last Modified :
Nov. 10, 2026, 12:40 a.m.
Remotely Exploit :
Yes !
Source :
sap
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | e4686d1a-f260-4930-ac4c-2f5c992778dd |
Solution
- Validate all input parameters for styling resources.
- Implement strict input validation on resource requests.
- Update the application to a secure version.
- Apply relevant security patches from the vendor.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-109810 vulnerability anywhere in the article.