CVE-2026-44759 Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-44759: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

The vulnerability of the administrative module for managing the SAP NetWeaver Enterprise Portal Administration, related to deserialization mechanism flaws, allows an attacker to execute arbitrary code.

The vulnerability of the administrative module for managing the SAP NetWeaver Enterprise Portal Administration is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Dozens of Vendors Patch Security Flaws Across Enterprise Software and Network Devices

SAP has released security updates to address two critical security flaws that could be exploited to achieve arbitrary code execution on affected systems. The vulnerabilities in question listed below - CVE-2019-17571 CVSS score: 9.8 - A code injection vulnerability in SAP Quotation Management...

CVE-2026-27685

SAP NetWeaver Enterprise Portal Administration is reported to be vulnerable to insecure deserialization when a privileged user uploads untrusted content, potentially affecting confidentiality, integrity, and availability of the host. The provided documents identify the affected product and the un...

CVE-2026-27685: Deserialization of Untrusted Data

SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system...

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform lies in the insufficient protection of the website structure, which allows attackers to execute arbitrary code.

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-0499: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2021-33703

Under certain conditions, NetWeaver Enterprise Portal, versions - 7.30, 7.31, 7.40, 7.50, does not sufficiently encode URL parameters. An attacker can craft a malicious link and send it to a victim. A successful attack results in Reflected Cross-Site Scripting XSS vulnerability...

CVE-2021-33702

Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An attacker can craft malicious data and print it to the report. In a successful attack, a victim opens the report, and the malicious script gets...

The vulnerability of the SAP NetWeaver Enterprise Portal (SAP NW EP) software integration platform lies in the insufficient protection of operational data during code debugging, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform SAP NW EP is related to insufficient protection of operational data during code debugging. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

EUVD-2025-201855

Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result...

CVE-2025-42872 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result...

CVE-2025-42872: Active Debug Code

Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result...

The vulnerability of the SAP NetWeaver Enterprise Portal (SAP NW EP) software integration platform lies in the improper elimination of special elements in data queries, allowing an attacker to gain access to read and modify data.

The vulnerability of the SAP NetWeaver Enterprise Portal software integration platform SAP NW EP is related to improper elimination of special elements in data requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read and modify data...

CVE-2025-42884: Improper Neutralization of Special Elements in Data Query Logic

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There i...

EUVD-2021-20379

Malware in sbrugna...

EUVD-2021-20380

Malware in sbrugna...

SAP NetWeaver Enterprise Portal Administration 代码问题漏洞

SAP NetWeaver Enterprise Portal Administration is an access control software from SAP, Germany. A code issue vulnerability exists in SAP NetWeaver Enterprise Portal Administration, which originates from a privileged user being able to upload untrusted content that, when deserialized, could impact...

CVE-2025-42980: Deserialization of Untrusted Data

SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...