Skip to content
OpenAdvisories

Product · SAP

SAP Commerce (Backoffice)

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.8
    CVE-2025-24874

    Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice

    SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame…

    SAP SAP Commerce (Backoffice)
  • Medium 5.4
    CVE-2024-45278

    Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice

    SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.

    SAP SAP Commerce (Backoffice)
  • Medium 5.4
    CVE-2024-41735

    Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice

    SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confidentiality and integrity of the application.

    SAP SAP Commerce (Backoffice)