SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad) before version 4.2 allows execution of JavaScript in a text module in Fiori BI Launchpad leading to Stored Cross Site Scripting vulnerability.