SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) before versions 4.2 and 4.3 does not sufficiently encode user-controlled inputs and allows an attacker to save malicious scripts in the publication name which can be executed later by the victim resulting in Stored Cross-Site Scripting.