SAP Business Objects Business Intelligence Platform (Web Intelligence HTML interface) versions 4.1 4.2 does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting (XSS) vulnerability.