Cross-Site Scripting (XSS) exists in SAP Business Objects Financial Consolidation prior to 2017-06-13, aka SAP Security Note 2422292.
sap businessobjects financial consolidation -