CVE-2026-34258
SAPUI5 Search UI URL Parameter Manipulation
Publication date: 2026-05-12
Last updated on: 2026-05-12
Assigner: SAP SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sap | sapui5 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-451 | The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in SAPUI5 (Search UI) where an unauthenticated attacker can manipulate specific URL parameters to inject malicious content.
If successfully exploited, it may cause users to be misled into clicking links that lead to attacker-controlled pages rendered by the application.
How can this vulnerability impact me? :
The impact of this vulnerability is low on confidentiality and has no effect on the integrity or availability of the application.
However, it can mislead users into accessing malicious pages, potentially exposing them to phishing or other social engineering attacks.