Unscored severity · published Jul 28, 2010
CVE-2010-2904
Multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter to testsdic and the (2) helpstring parameter to paramhelp.jsp.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netweaver · Sap
6.4; 7.0 · source: NVD
SL
System Landscape Directory · Sap
6.4; 7.0; 7.02 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-2904
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-2904
dsecrg.com
http://dsecrg.com/pages/vul/show.php?id=168
packetstormsecurity.org
http://packetstormsecurity.org/1007-advisories/DSECRG-09-068.txt
Vendor Advisory
http://secunia.com/advisories/40712
www.osvdb.org
http://www.osvdb.org/66639
www.osvdb.org
http://www.osvdb.org/66640
Vendor Advisory
http://www.vupen.com/english/advisories/2010/1935
More from Netweaver
10.0
CVE-2020-6287
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
10.0
CVE-2010-5326
SAP NetWeaver Remote Code Execution Vulnerability
9.8
CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
9.8
CVE-2016-2386
SAP NetWeaver SQL Injection Vulnerability
9.1
CVE-2025-42999
Insecure Deserialization in SAP NetWeaver (Visual Composer development server)