CVE-2026-58231

Скрипт обнаружения CVE-2026-58231 Инструмент обнаружения и проверки предусловий для CVE-2026-58231 — некорректная авторизация в компоненте Data Hub Adapter продукта SAP Commerce Cloud CVSS 10.0. Скрипт выполняет только неразрушающие проверки. Он не содержит и не выполняет полезной нагрузки для...

SAP_RECON

PoC для CVE-2020-6287, CVE-2020-6286 уязвимость SAP RECON Пффф! RECON Remotely Exploitable Code On NetWeaver? Ребята, серьёзно? Это лучшее кодовое имя, которое вы придумали? : Этот скрипт позволяет проверить уязвимость отсутствия проверки авторизации в SAP LM Configuration Wizard, а в качестве...

powersap

PowerSAP PowerSAP est une simple réimplémentation PowerShell de techniques populaires et efficaces de tous les outils publics tels que Bizploit, les modules auxiliaires Metasploit ou les scripts Python disponibles sur Internet. Cette réimplémentation ne contient aucune vulnérabilité nouvelle ou n...

CVE-2025-42944

CVE-2025-42944 Из-за уязвимости десериализации в SAP NetWeaver неаутентифицированный злоумышленник может эксплуатировать систему через модуль RMI-P4, отправляя вредоносную полезную нагрузку на открытый порт. Десериализация таких недоверенных Java-объектов может привести к произвольному выполнению...

SAPGateBreaker-Exploit

CVE-2022-22536 : Contrebande HTTP à travers la porte d'entrée SAP SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 et SAP Web Dispatcher sont vulnérables à la contrebande de requêtes et à la concaténation de requêtes. Un attaquan...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

sap-netweaver-0day-CVE-2025-31324

Le SUPERGROUP connu sous le nom de Scattered Lapsus$ Hunters - Une combinaison de groupes parmi ShinyHunters, Scattered Spider et Lapsus$ ont divulgué le POC de cette 0day Cette 0day a été créée par ShinyHunters et volée aux acteurs étatiques chinois en exploitation active. Divulgué ici:...

HoneySAP

HoneySAP: SAP Low-interaction honeypot Version 0.1.2.dev0 XXX 2022 Overview HoneySAP is a low-interaction research-focused honeypot specific for SAP services. It's aimed at learn the techniques and motivations behind attacks against SAP systems. Features low-interaction honeypot for SAP services...

CVE-2020-6308-PoC

CVE-2020-6308 POC SAP La plateforme SAP BusinessObjects Business Intelligence Web Services versions - 410, 420, 430, permet à un attaquant non authentifié d'injecter des valeurs arbitraires en tant que paramètres CMS pour effectuer des recherches sur le réseau interne, autrement inaccessible depu...

SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting

SAP Knowledge Warehouse 7.30, 7.31, 7.40, and 7.50 contain a reflected cross-site scripting vulnerability via the usage of one SAP KW component within a web browser. id: CVE-2021-42063 info: name: SAP Knowledge Warehouse =7.5.1 to mitigate the XSS vulnerability. reference: -...

SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

SAP Solution Manager - Open Redirect

SAP Solution Manager contains an open redirect vulnerability via the logoff endpoint. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-26836 info: name: SAP Solution Manager - Open...

SAP Internet Graphics Server (IGS) - XML External Entity Injection

SAP Internet Graphics Servers IGS running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag...

SCIMono <0.0.19 - Remote Code Execution

SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and execute java expressions and compromise the availability and integrity of the system. id: CVE-2021-21479 info: name: SCIMono 0.0.19 - Remote Code Execution author: dwisiswant0 severit...

SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

SAP BusinessObjects Business Intelligence Platform Web Services 410, 420, and 430 is susceptible to blind server-side request forgery. An attacker can inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful...

SAP Web Application Server 6.x/7.0 - Open Redirect

frameset.htm in the BSP runtime in SAP Web Application Server WAS 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter. id: CVE-2005-3634 info: name: SAP Web...

SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion

SAP xMII 15.0 for SAP NetWeaver 7.4 is susceptible to a local file inclusion vulnerability in the GetFileList function. This can allow remote attackers to read arbitrary files via a .. dot dot in the path parameter to /Catalog, aka SAP Security Note 2230978. id: CVE-2016-2389 info: name: SAP xMII...

CVE-2022-22536

CVE-2022-22536 Vulnérabilité de désynchronisation des pipes mémoire SAP MPI CVE-2022-22536. Description - POC pour CVE-2022-22536 : vulnérabilité de désynchronisation des pipes mémoire SAP MPI. - créé par antx le 15/02/2022. Détail SAP NetWeaver Application Server ABAP, SAP NetWeaver Application...

SAP_EEM_CVE-2020-6207

CVE-2020-6207 에 대한 PoC SAP Solution Manager의 인증 확인 누락 이 스크립트는 SAP Solution Manager에 연결된 SAP SMDAgent에서 RCE로 이어지는 SAP EEM 서블릿tcsmdagentapplicationeem의 인증 확인 누락을 확인하고 악용할 수 있게 해줍니다. 원본 발견: Pablo Artuso Yvan 'iggy' G 논문: An Unauthenticated Journey to Root :Pwning Your Company's Enterprise Software...

RFCpwn

RFCpwn Набор инструментов для перечисления и эксплуатации SAP с использованием вызовов SAP RFC Твиттер: @icryo Это набор инструментов для демонстрации последствий компрометации служебных учетных записей. Эта PoC не предназначена для использования в производственных средах, нет гарантии стабильнос...