SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) before versions 4.2 does not sufficiently encode user-controlled inputs and allows an attacker to store malicious scripts in the input controls resulting in Stored Cross-Site Scripting.