SAP Wily Introscope Enterprise Manager 代码注入漏洞

SAP Wily Introscope Enterprise Manager is an application performance management component from SAP, Germany. A code injection vulnerability exists in SAP Wily Introscope Enterprise Manager, which stems from the use of a vulnerable third-party component, and could allow an unauthenticated attacker...

PT-2026-2329

Name of the Vulnerable Software and Affected Versions SAP Fiori App Intercompany Balance Reconciliation affected versions not specified Description A Cross-Site Request Forgery CSRF issue exists in SAP Fiori App Intercompany Balance Reconciliation. An attacker may be able to perform actions that...

PT-2026-2332

Name of the Vulnerable Software and Affected Versions SAP Fiori App Intercompany Balance Reconciliation affected versions not specified Description The application allows an attacker with high privileges to upload any file, including script files, without proper file format validation. This has a...

CVE-2026-0503: Missing Authorization

Due to missing authorization check in the SAP ERP Central Component SAP ECC and SAP S/4HANA SAP EHS Management, an attacker could extract hardcoded clear-text credentials and bypass the password authentication check by manipulating user parameters. Upon successful exploitation, the attacker can...

CVE-2026-0497: Missing Authorization

SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This results in a low impact on confidentiality, with no impact on integrity or availability of the application...

CVE-2026-0501: Improper Neutralization of Special Elements used in an SQL Command

Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise Financials General Ledger, an authenticated user could execute crafted SQL queries to read, modify, and delete backend database data. This leads to a high impact on the confidentiality, integrity, and availability of...

SAP Application Server for ABAP 操作系统命令注入漏洞

SAP Application Server for ABAP is a load balancing, memory management platform from SAP, Germany. SAP Application Server for ABAP suffers from an operating system command injection vulnerability that stems from OS command injection, which could lead to an authenticated attacker uploading special...

PT-2026-2328

Name of the Vulnerable Software and Affected Versions SAP HANA database affected versions not specified Description The SAP HANA database has a flaw that allows privilege escalation. An attacker with valid credentials for any user can switch to another user, potentially gaining administrative...

PT-2026-2345

Name of the Vulnerable Software and Affected Versions SAP Business Connector affected versions not specified Description A Cross-Site Scripting XSS issue exists in SAP Business Connector. An unauthenticated attacker can create a malicious link. If a user clicks this link, they may be redirected t...

PT-2026-2334

Name of the Vulnerable Software and Affected Versions SAP S/4HANA Private Cloud and On-Premise affected versions not specified Description The software contains a flaw in a function module exposed via Remote Function Call RFC. An attacker with administrative privileges can exploit this to inject...

CVE-2026-0511: Missing Authorization

SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high impact on confidentiality and integrity of the application ,availability is not impacted...

PT-2026-2330

Name of the Vulnerable Software and Affected Versions SAP Fiori App Intercompany Balance Reconciliation application affected versions not specified Description Under certain conditions, the SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access restricted...

CVE-2026-0492: Missing Authentication for Critical Function

SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality, integrity, and availability...

CVE-2026-0495: External Control of System or Configuration Setting

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arbitrary emails which could enable effective phishing campaigns. This has low impact on confidentiality, integrity and availability of the application...

CVE-2026-0494: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low impact on confidentiality of the application, integrity and availability are not impacted...

CVE-2026-0513: URL Redirection to Untrusted Site

Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management SICF Handler in SRM Catalog, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an attacker-controlled site.This causes low impact on integrity of the application...

CVE-2026-0493: Cross-Site Request Forgery (CSRF)

Due to a Cross-Site Request Forgery CSRF vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacker could execute state?changing actions using an inappropriate request type, this deviation from expected request semantics may allow an attacker to trigger unintended actions on...

SAP NetWeaver Enterprise Portal 跨站脚本漏洞

SAP NetWeaver Enterprise Portal is a web front-end component of SAP NetWeaver from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Enterprise Portal, which originates from an unauthenticated attacker being able to inject malicious scripts into URL parameters, which coul...

CVE-2026-0514: Improper Neutralization of Input During Web Page Generation

Due to a Cross-Site Scripting XSS vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting user clicks this link, the user may be redirected to a site controlled by the attacker. Successful exploitation could allow the attacker to...

SAP Business Connector 跨站脚本漏洞

SAP Business Connector is a middleware from SAP, Germany. A cross-site scripting vulnerability exists in SAP Business Connector that originates in cross-site scripting and could allow an unauthenticated attacker to craft a malicious link to redirect users to a site under the attacker's control,...