CVE-2025-42999

CVE-2025-42999 affects SAP NetWeaver Visual Composer Metadata Uploader. It is a deserialization vulnerability that can allow a privileged attacker to compromise confidentiality, integrity, and availability of the host system. Connected documents corroborate a broader context: CVE-2025-31324 (unre...

CVE-2025-31329

Summary: CVE-2025-31329 affects SAP NetWeaver (ABAP/ABAP Platform) with an information-disclosure via malicious instructions injected into user configuration settings. An administrator can craft instructions that, when loaded by the victim, exposes credentials and enables unauthorized access to l...

CVE-2025-31329 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can craft these instructions so that when accessed by the victim, sensitive information such as use...

CVE-2025-31329 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform

SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can craft these instructions so that when accessed by the victim, sensitive information such as use...

SAP Gateway Client 安全漏洞

SAP Gateway Client is an OData service test and debugging tool from SAP Germany, integrated into SAP NetWeaver Gateway. An information disclosure vulnerability exists in SAP Gateway Client that stems from improper privilege management and can be exploited by an attacker to cause information...

PT-2025-20810 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver affected versions not specified Description: The issue is caused by the injection of malicious instructions into user configuration settings, allowing an attacker with administrative privileges to expose sensitive information su...

SAP NetWeaver 安全漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. An information disclosure vulnerability exists in SAP NetWeaver, which can be exploited by an attacker to...

PT-2025-20812

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Visual Composer affected versions not specified Description The issue arises when a privileged user uploads untrusted or malicious content, which upon deserialization, could compromise the confidentiality, integrity, and...

SAP NetWeaver Visual Composer Metadata Uploader 安全漏洞

SAP NetWeaver Visual Composer Metadata Uploader is a component in SAP NetWeaver for uploading metadata. A deserialization vulnerability exists in SAP NetWeaver Visual Composer Metadata Uploader that originates from deserializing malicious content, which can be exploited by an attacker to cause a...

CVE-2025-42999

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system. Recent assessments: Assessed Attacker...

PT-2025-20803 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver affected versions not specified Description: A critical issue in SAP NetWeaver is being actively exploited by Chinese state-sponsored hackers. Organizations are urged to patch immediately to mitigate the risk. Recommendations: A...

Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver

CVE-2025-31324 A proof of concept developed to exploit CVE-2...

Chinese Hackers Exploit SAP RCE Flaw CVE-2025-31324, Deploy Golang-Based SuperShell

A China-linked unnamed threat actor dubbed Chaya004 has been observed exploiting a recently disclosed security flaw in SAP NetWeaver. Forescout Vedere Labs, in a report published Thursday, said it uncovered a malicious infrastructure likely associated with the hacking group weaponizing...

PT-2025-20587 · Undefined · Undefined

CVE-2024-37009 is a critical RCE flaw in SAP NetWeaver AS Java, now being exploited by a Chinese threat group. The vulnerability allows unauthenticated attackers to fully compromise systems via the LM Configuration Wizard. SAP has issued a patch. Update immediately. SAP https://t.co/wk3OSxRmbZ...

Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver

CVE-2025-31324 Zero-Day SAP Vulnerability & Compromise Assessm...

Vulnerabilities fixed in SAP products

SAP has fixed vulnerabilities in several products, including SAP Financial Consolidation, SAP Landscape Transformation, SAP NetWeaver Application Server ABAP, SAP Commerce Cloud, SAP ERP BW, SAP BusinessObjects Business Intelligence Platform, SAP KMC WPC, SAP Solution Manager, SAP S4CORE, and SAP...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-31324link is external SAP NetWeaver Unrestricted File Upload Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors...

Exploit for Unrestricted Upload of File with Dangerous Type in Sap Netweaver

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauth...

SAP NetWeaver Unrestricted File Upload Vulnerability

SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries...

SAP NetWeaver Visual Composer Metadata Uploader Arbitrary File Upload

SAP NetWeaver Visual Composer Metadata Uploader is affected by an improper authorization vulnerability allowing an unauthenticated attacker to upload arbitrary files allowing to achieve a Remote Code Execution. No source data...