Multiple GitLab Flaws Could Allow Account Takeover and Stored XSS Attacks

SAP has deployed comprehensive security patches on August 12, 2025, addressing a total of 15 vulnerabilities across its enterprise software ecosystem, with particular emphasis on three critical code injection vulnerabilities that pose significant risks to organizational infrastructure.

The security update represents a substantial effort by SAP to maintain the integrity of its widely deployed enterprise resource planning and business application platforms used by millions of organizations worldwide.

Critical Code Injection Vulnerabilities

The most concerning aspects of this security patch cycle involve three severe code injection vulnerabilities that could potentially allow attackers to execute arbitrary code within SAP environments.

These injection flaws represent a high-priority security concern as they can enable attackers to bypass authentication mechanisms, access sensitive business data, and potentially gain administrative privileges within affected SAP systems.

Code injection vulnerabilities typically occur when applications fail to properly validate user input, allowing malicious actors to insert executable code that gets processed by the system.

The technical implications of these injection vulnerabilities are particularly severe in enterprise environments where SAP systems often serve as the backbone for critical business operations.

Successful exploitation could lead to SQL injection attacks, LDAP injection, or command injection scenarios, depending on the specific vulnerability vectors.

Organizations running affected SAP versions should prioritize these updates as part of their immediate patch management protocols, as delayed implementation could expose sensitive financial data, human resources information, and proprietary business intelligence.

Comprehensive Vulnerability

Beyond the three critical injection flaws, the remaining 12 vulnerabilities encompass various security weaknesses across SAP’s product portfolio.

These include cross-site scripting (XSS) vulnerabilities, privilege escalation flaws, authentication bypass issues, and information disclosure vulnerabilities.

The breadth of these security issues indicates systematic security testing and remediation efforts by SAP’s security team.

CVE ID	Vulnerability Type	Severity	CVSS Score
CVE-2025-7734	Cross-site scripting in blob viewer	High	8.7
CVE-2025-7739	Cross-site scripting in labels	High	8.7
CVE-2025-6186	Cross-site scripting in Workitem	High	8.7
CVE-2025-8094	Improper permissions in project API	High	7.7
CVE-2024-12303	Incorrect privilege assignment	Medium	6.7
CVE-2025-2614	Resource allocation limits bypass	Medium	6.5
CVE-2024-10219	Incorrect authorization in jobs API	Medium	6.5
CVE-2025-8770	Merge request approval bypass	Medium	6.5
CVE-2025-2937	RegEx complexity in wiki	Medium	6.5
CVE-2025-1477	Resource limits in Mattermost integration	Medium	6.5
CVE-2025-5819	Permission assignment in ID token	Medium	5.0
CVE-2025-2498	Access control in IP restrictions	Low	Improper permissions in the project API

The Common Vulnerability Scoring System (CVSS) ratings for these vulnerabilities range from medium to critical severity levels, with the injection flaws receiving the highest priority classifications.

SAP’s security advisory includes detailed Common Vulnerabilities and Exposures (CVE) identifiers for each flaw, enabling security teams to correlate these updates with their vulnerability management systems and threat intelligence feeds.

Enterprise security administrators should implement these patches through SAP’s standard update mechanisms, ensuring proper testing in development environments before production deployment.

The comprehensive nature of this security update underscores the importance of maintaining current SAP installations and implementing robust patch management procedures to protect critical business systems from emerging cyber threats.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates

The post Multiple GitLab Flaws Could Allow Account Takeover and Stored XSS Attacks appeared first on Cyber Security News.