CVE-2026-109795 Missing authorization check in S4CRM

SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arbitrary code within the affected syste...

CVE-2019-0368

SAP Customer Relationship Management Email Management, versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7.14, does not sufficiently encode user-controlled inputs within the mail client resulting in Cross-Site Scripting vulnerability...

Cross site scripting

SAP Customer Relationship Management Email Management, versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7.14, does not sufficiently encode user-controlled inputs within the mail client resulting in Cross-Site Scripting vulnerability...

CVE-2019-0368

The CVE-2019-0368 entry concerns SAP Customer Relationship Management (CRM) Email Management. Affected products/versions include SAP S4CRM before 1.0 and 2.0, and BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13, and 7.14. The root cause is insufficient encoding of user-controlled inputs within the mail...