{"affected":[{"defaultStatus":"unaffected","product":"SAP NetWeaver Visual Composer","source":"CNA: sap","vendor":"SAP_SE","versions":[{"status":"affected","version":"VC70RUNTIME 7.50"}]}],"cveId":"CVE-2026-120016","cwes":["CWE-79"],"description":"SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.1,"severity":"medium","source":"CNA: sap","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794271369968,"publishedAt":1794271369968,"references":[{"source":"CNA: sap","tags":[],"url":"https://me.sap.com/notes/3806484"},{"source":"CNA: sap","tags":[],"url":"https://url.sap/sapsecuritypatchday"}],"remediation":[],"revision":"4b046f87e06862e270340a10166941fb9256ded5eacf61b7e0a57dc562f39723","sources":[{"modifiedAt":1794271369968,"name":"CNA: sap","retrievedAt":1794272932160,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120016"}],"ssvc":null,"status":"published","title":"Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Visual Composer","updatedAt":1794272932160}