CVE-2026-120016
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Nov 10, 2026
Vendor
unknown
Description
SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability.