CVE-2005-3635: SAP Web Application Server

Medium severity, CVSS 4.3. EPSS: 5% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in SAP Web Application Server (WAS) 6.10 through 7.00 allow remote attackers to inject arbitrary web script or HTML via (1) the sap-syscmd in sap-syscmd and (2) the BspApplication field in the SYSTEM PUBLIC test application.

Affected products

• SAP SAP Web Application Server: version 6.10 only; version 6.20 only; version 6.40 only; version 7.0 only

Published 2005-11-16. Last modified 2026-06-16.