CVE-2016-2386

CVE-2016-2386 SAP NetWeaver AS JAVA UDDI-Komponente SQL Injection root@kitploit: POST /UDDISecurityService/UDDISecurityImplBean HTTP/1.1 Host: host Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78...

CVE-2021-38163

CVE-2021-38163 CVE-2021-38163 - Exploit für SAP Netveawer SAP NetWeaver Visual Composer 7.0 RT Versionen – 7.30, 7.31, 7.40, 7.50 – ohne Einschränkung: Ein Angreifer, der als nicht-administrativer Benutzer authentifiziert ist, kann eine schädliche Datei über ein Netzwerk hochladen und deren...

CVE-2020-6287_RECON-scanner

Scanner für Schwachstellenbewertung und Indikatoren für Kompromittierung IoC für CVE-2020-6287 RECON RECON Remotely Exploitable Code On NetWeaver ist eine kritische Schwachstelle CVSSv3 10, die eine Reihe von SAP-Geschäfts- und technischen Anwendungen betrifft, die auf dem SAP-NetWeaver-Java-Stac...

Onapsis_CVE-2025-31324_Scanner_Tools

Scanner für Schwachstellen und Kompromittierungsindikatoren IoC für CVE-2025-31324 Schwachstelle im Visual-Composer-Metadata-Uploader CVE-2025-31324 ist eine kritische Schwachstelle CVSSv3 10, die SAP-NetWeaver-Systeme betrifft, insbesondere die Komponente Visual Composer Metadata-Uploader. Diese...

CVE-2020-6287_SAP-NetWeaver-bypass-auth

CVE-2020-6287SAP-NetWeaver-bypass-auth Exploit automatizzato per CVE-2020-6287 CVE-2020-6287: SAP NetWeaver AS JAVA LM Configuration Wizard, versioni - 7.30, 7.31, 7.40, 7.50, non esegue un controllo di autenticazione che consente a un utente malintenzionato senza autenticazione preventiva di...

Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment

CVE-2025-31324 Strumento di Valutazione delle Vulnerabilità e Compromissione Zero-Day SAP Rilascio Congiunto da parte di Onapsis e Mandiant Onapsis e Mandiant hanno collaborato per rilasciare uno strumento open-source per assistere i clienti SAP nell'identificazione di potenziali compromissioni...

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP-Schmuggel durch SAPs Haupteingang SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 und SAP Web Dispatcher sind anfällig für Request-Smuggling und Request-Verkettung. Ein nicht authentifizierter Angreifer kann...

SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

SAP Memory Pipes (MPI) Desynchronization

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation attacks. An unauthenticated attacker can prepend a victim's request with arbitrary data. This...

Burp_CVE-2025-31324

Extensão Burp Suite CVE-2025-31324 Visão Geral Esta extensão do Burp Suite baseada em Python foi projetada para detectar a presença da CVE-2025-31324 , uma vulnerabilidade crítica no componente Metadata Uploader do SAP NetWeaver Visual Composer. A vulnerabilidade permite a execução remota de códi...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC Proof-of-Concept für CVE-2025-31324: Unauthentifizierter Upload im SAP NetWeaver Visual Composer Metadata Uploader Dieses Skript führt Folgendes aus: 1. Datei-Upload an den verwundbaren Endpunkt über Upload-Host/Port 2. Optionaler Trigger via HTTP GET über Trigger-Host/Port 3...

CVE-2017-12637_SAP-NetWeaver-URL-Traversal

CVE-2017-12637SAP-NetWeaver-URL-Traversal Scanner LFI proof-of-concept: rilevamento automatico delle esposizioni di /etc/passwd tramite directory traversal e corrispondenza regex. root@kitploit: Scanner LFI Un proof-of-concept Python leggero per scansionare host target per vulnerabilità di Local...

CVE-2025-31324_PoC

CVE-2025-31324PoC Proof-of-Concept per CVE-2025-31324: caricamento non autenticato in SAP NetWeaver Visual Composer Metadata Uploader Questo script esegue: 1. Caricamento del file sull'endpoint vulnerabile tramite host/porta Upload 2. Attivazione opzionale tramite HTTP GET tramite host/porta...

SAP NetWeaver OS Command Injection (3745182)

The version of the SAP NetWeaver kernel detected on the remote host is affected by an OS command injection vulnerability as referenced in SAP Security Note 3745182: - SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls...

SAP NetWeaver Memory Corruption (3756674)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3756674: - SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose...

SAP NetWeaver AS ABAP Missing Authorization Check (3752864)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a missing authorization check vulnerability as referenced in SAP Security Note 3752864: - SAP NetWeaver and ABAP Platform Change and Transport System - Customer Transport Integration Wizard allows a low-privileged use...

SAP NetWeaver AS Java Vulnerable Third-Party Component (3758318)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by the use of a vulnerable third-party component as referenced in SAP Security Note 3758318: - SAP NetWeaver Application Server Java Adobe Document Service uses outdated open source cryptographic and data...

SAP NetWeaver Memory Corruption (3714806)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3714806: - SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting...

SAP NetWeaver AS ABAP Privilege Escalation (3772411)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a privilege escalation vulnerability as referenced in SAP Security Note 3772411: - SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low...

SAP NetWeaver AS ABAP XSS (3721424)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3721424: - Due to a Cross-Site Scripting XSS vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a...