SAML 1.1 SSO Demo Application in SAP NetWeaver Java Application Server (J2EE-APPS) versions 7.10 to 7.11 7.20 7.30 7.31 7.40 and 7.50 does not sufficiently encode user-controlled inputs which results in cross-site scripting (XSS) vulnerability.