CVE-2021-38183: SAP NetWeaver

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in Cross-Site Scripting vulnerability.

Affected products

• SAP NetWeaver: version 700 only; version 701 only; version 702 only; version 730 only

Published 2021-10-12. Last modified 2026-06-17.