Vendor
SAP
1,623 known vulnerabilities.
Products
25 results · Clear filters · Feed
-
Critical 10.0CVE-2026-76964 Public exploit
Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected fu…
-
High 7.5CVE-2026-58249 Public exploit
Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager)
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the…
-
Critical 10.0CVE-2026-58231 Public exploit
Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise …
-
Critical 10.0CVE-2025-42944 Public exploit
Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary…
-
Critical 9.9CVE-2025-42957 Public exploit
Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effecti…
-
Critical 10.0
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the conf…
KEV Apr 29, 2025 -
Medium 5.4CVE-2025-0054 Public exploit
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java
SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be la…
-
Critical 9.1CVE-2024-22127 Public exploit
Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands…
-
Critical 9.9CVE-2022-41272 Public exploit
An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined S…
-
Unscored —CVE-2022-39802 Public exploit
SAP Manufacturing Execution - versions 15.1, 15.2, 15.3, allows an attacker to exploit insufficient validation of a fil…
-
Unscored —
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does …
-
Critical 9.8
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 an…
KEV Aug 18, 2022 -
Unscored —
A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30, 7.31, 7.40, 7.50. The usag…
-
Critical 9.9
Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Comp…
-
Critical 9.9
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticate…
KEV Jun 9, 2022 -
High 7.6CVE-2021-33699 Public exploit
Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in…
-
Medium 5.3
SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated a…
-
Critical 10.0CVE-2020-6364 Public exploit
SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an at…
-
Critical 10.0
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication …
KEV Nov 3, 2021 -
Medium 5.3
The insufficient input path validation of certain parameter in the web service of SAP NetWeaver AS JAVA (LM Configurati…
-
Critical 10.0
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform a…
KEV Nov 3, 2021 -
Unscored —CVE-2019-0285 Public exploit
The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive databa…
-
Medium 6.6
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information p…
KEV Nov 3, 2021 -
Unscored —
Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML Exte…
-
Unscored —
Under certain conditions SAP Internet Graphics Server (IGS) 7.20, 7.20EXT, 7.45, 7.49, 7.53, fails to validate XML Exte…