Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite Extension Overview This Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324 , a critical vulnerability in SAP NetWeaver Visual Composer’s Metadata Uploader component. The vulnerability allows unauthenticated remote code execution via fi...

SAP_RECON

PoC for CVE-2020-6287, CVE-2020-6286 SAP RECON vulnerability Pffff! RECON Remotely Exploitable Code On NetWeaver? Guys, really? That was the best codename you came up with? : This scrip allows to check SAP LM Configuration Wizard missing authorization check vulnerability and as a PoC script...

CVE-2025-31324

CVE-2025-31324 Proof-of-Concept 0day for SAP NetWeaver created by ShinyHunters CVE-2025-31324 is a critical "Unrestricted File Upload" vulnerability affecting the SAP NetWeaver Application Server AS Java. Specifically, it resides within the Visual Composer component VCFRAMEWORK. The flaw allows a...

sap-netweaver-0day-CVE-2025-31324

The SUPERGROUP known as Scattered Lapsus$ Hunters - A combination of groups among ShinyHunters, Scattered Spider, and Lapsus$ have leaked the POC to this 0day This 0day was created by ShinyHunters and stolen from the Chinese state actors in active exploitation. Leaked here:...

CVE-2025-31324

CVE-2025-31324 A proof of concept developed to exploit CVE-2025-31324. Usage usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this help message and...

CVE-2017-12637_SAP-NetWeaver-URL-Traversal

CVE-2017-12637SAP-NetWeaver-URL-Traversal Proof-of-concept LFI Scanner: Automated detection of /etc/passwd exposures via directory traversal and regex matching. LFI Scanner A lightweight Python proof-of-concept to scan target hosts for Local File Inclusion LFI vulnerabilities by attempting to...

CVE-2020-6287_SAP-NetWeaver-bypass-auth

CVE-2020-6287SAP-NetWeaver-bypass-auth Automated Exploit for CVE-2020-6287 CVE-2020-6287: SAP NetWeaver AS JAVA LM Configuration Wizard, versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks...

CVE-2021-33690

CVE-2021-33690 CVE-2021-33690 Server Side Request Forgery vulnerability in SAP NetWeaver Development Infrastructure Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver Development Infrastructure Component Build Service versions – 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 Vendor URL:...

Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment

CVE-2025-31324 Zero-Day SAP Vulnerability & Compromise Assessment Tool Joint Release by Onapsis & Mandiant Onapsis and Mandiant have collaborated to release an open-source tool to assist SAP customers in identifying potential compromise related to CVE-2025-31324 and CVE-2025-42999 , a critical...

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP Smuggling Through SAP's Front Door SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepe...

CVE-2020-6286

CVE-2020-6286 SAP NetWeaver AS JAVA LM Configuration Wizard Directory Traversal SAP NetWeaver is SAP’s integrated technology platform and the technical foundation of all SAP applications since SAP Business Suite. SAP NetWeaver is a service-oriented application and integration platform that provid...

CVE-2020-6287_RECON-scanner

Vulnerability Assessment and Indicator of Compromise IoC Scanner for CVE-2020-6287 RECON RECON Remotely Exploitable Code On NetWeaver is a critical CVSSv3 10 vulnerability affecting a number of SAP business and technical applications running on top of the SAP NetWeaver Java stack. This...

CVE-2025-31324_PoC

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

CYB401-CVE-2026-58249-Analysis

CYB401-CVE-2026-58249-Analysis CVE-2026-58249: SAP NetWeaver / Web Dispatcher Memory Corruption Vulnerability Oloko Toluwalope Isaac Matric No: RUN/CYB/23/15411 CYB 401 1. INTRODUCTION CVE-2026-58249 is a high-severity memory corruption flaw in the Internet Communication Manager ICM used by SAP...

CVE-2025-31324

Info ░█▄█░█▀█░█░█░█░█░█░█░▀█▀░█▀█░█▀█░█▀▄░█░█ ░█░█░█▀▀░█░█░█░█░█▄█░░█░░█░█░█░█░█▀▄░░█░ ░▀░▀░▀░░░▀▀▀░▀▀▀░▀░▀░▀▀▀░▀░▀░▀░▀░▀░▀░░▀░ N U L L T R A C E // NullTrace :: No logs. No noise. Just signal. // ----- SIGNATURE----- Key: ssh-rsa AAAAB3...NullKey...KFA== Fingerprint:...

CVE-2018-2380

CVE-2018-2380 CVSS v3 Base Score: 6.6/10 PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM Script usage example python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true Where --host is a SAP server...

Onapsis_CVE-2025-31324_Scanner_Tools

Vulnerability and Indicator of Compromise IoC Scanner for CVE-2025-31324 Visual Composer Metadata Uploader Vulnerability CVE-2025-31324 is a critical CVSSv3 10 vulnerability affecting SAP NetWeaver systems, specifically within the Visual Composer Metadata Uploader component. This vulnerability...

CVE-2022-22536

CVE-2022-22536 SAP memory pipes desynchronization vulnerabilityMPI CVE-2022-22536. Description - POC for CVE-2022-22536: SAP memory pipesMPI desynchronization vulnerability. - create by antx at 2022-02-15. Detail SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP...

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536 What is the vulnerability about? SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request...

SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...