CVE-2016-1911

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.02%

Published

Jan 15, 2016

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Multiple cross-site scripting (XSS) vulnerabilities in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to the (1) Runtime Workbench (RWB) or (2) Pmitest servlet in the Process Monitoring Infrastructure (PMI), aka SAP Security Notes 2206793 and 2234918.

Weaknesses (CWE)

CWE-79

Affected Products (1)

sap · netweavervulnerable

References (10)

http://seclists.org/fulldisclosure/2016/Apr/58

http://seclists.org/fulldisclosure/2016/Apr/64

https://erpscan.io/advisories/erpscan-16-001-xss-sap-netweaver-7-4-mdt-servlet/

https://erpscan.io/advisories/erpscan-16-004-sap-netweaver-7-4-pmitest-servlet-xss/

https://erpscan.io/press-center/blog/sap-security-notes-january-2016-review/

http://seclists.org/fulldisclosure/2016/Apr/58

http://seclists.org/fulldisclosure/2016/Apr/64

https://erpscan.io/advisories/erpscan-16-001-xss-sap-netweaver-7-4-mdt-servlet/

https://erpscan.io/advisories/erpscan-16-004-sap-netweaver-7-4-pmitest-servlet-xss/

https://erpscan.io/press-center/blog/sap-security-notes-january-2016-review/

KEV Catalog EPSS Scores Vendors All CVEs