CVE-2025-27429: Improper Control of Generation of Code

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating...

CVE-2025-26653: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting XSS vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. When a user visits the compromised page,...

CVE-2025-23186: Improper Control of Generation of Code

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely...

SAP NetWeaver Server ABAP Information Disclosure Vulnerability (CNVD-2025-07609)

SAP NetWeaver Server ABAP is an application server from SAP Germany. An information disclosure vulnerability exists in SAP NetWeaver Server ABAP. The vulnerability stems from the server generating different responses depending on the presence or absence of a particular user, thereby disclosing...

CVE-2025-25242

SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity...

CVE-2025-27432

CVE-2025-27432 concerns the SAP eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil. An authenticated attacker with certain privileges can call any transaction by executing a specific ABAP method and view inbound delivery details, as described by multiple sources. The vulnerab...

CVE-2025-26659

CVE-2025-26659 – SAP NetWeaver ABAP (WebGUI) is a DOM-based XSS vulnerability caused by insufficient encoding of user-controlled inputs in the SAP NetWeaver Application Server ABAP. The flaw allows an attacker with no privileges to craft a malicious web message that executes JavaScript in the vic...

CVE-2025-25242 Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP

SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity...

PT-2025-10673

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description The issue is related to a DOM-based Cross-Site Scripting XSS vulnerability. It occurs because the software does not sufficiently encode user-controlled inputs...

PT-2025-10667

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description The issue allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the...

PT-2025-10678

Name of the Vulnerable Software and Affected Versions SAP Electronic Invoicing for Brazil affected versions not specified Description The issue allows an authenticated attacker with certain privileges to gain unauthorized access to each transaction, potentially affecting the confidentiality of th...

PT-2025-10675

Name of the Vulnerable Software and Affected Versions SAP NetWeaver ABAP Class Builder affected versions not specified Description The issue is due to a missing authorization check, allowing an attacker to escalate privileges and gain higher access levels. This could result in the disclosure of...

CVE-2025-27432: Missing Authorization

The eDocument Cockpit Inbound NF-e in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized access to each transaction. By executing the specific ABAP method within the ABAP system, an unauthorized attacker could call each transaction an...

CVE-2025-26661: Missing Authorization

Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...

CVE-2025-26659: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting XSS vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the...

CVE-2025-25242: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity...

CVE-2025-24872

The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact...

CVE-2025-24872

The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact...

CVE-2025-24872 Missing Authorization check in SAP ABAP Platform (ABAP Build Framework)

The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact...

CVE-2025-24872

CVE-2025-24872 concerns the SAP ABAP Platform, specifically the ABAP Build Framework. The authenticated attacker can gain unauthorized access to a specific transaction by invoking the add-on build functionality, allowing viewing of the transaction details. The documented impact is limited to conf...