CVE-2025-30009

CVE-2025-30009 affects the SAP Supplier Relationship Management (SRM) Live Auction Cockpit. The issue stems from a deprecated Java applet in affected SRM packages, allowing an unauthenticated attacker to execute malicious script in the victim’s browser. Reported impact is limited to the victim’s ...

CVE-2025-30009 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

he Live Auction Cockpit in SAP Supplier Relationship Management SRM uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute malicious script in the victim�s browser. This vulnerability has low impact on confidentiality and...

CVE-2025-30009 Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)

he Live Auction Cockpit in SAP Supplier Relationship Management SRM uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute malicious script in the victim�s browser. This vulnerability has low impact on confidentiality and...

CVE-2025-26662 Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

CVE-2025-26662 Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This...

CVE-2025-26662

CVE-2025-26662 describes a Cross-Site Scripting vulnerability in the SAP Data Services Management Console caused by insufficient encoding of user-controlled input. If a logged-in user clicks a crafted link, injected script executes in the victim’s browser, potentially impacting confidentiality an...

PT-2025-20819 · Sap · Sap Service Parts Management

Name of the Vulnerable Software and Affected Versions: SAP Service Parts Management SPM affected versions not specified Description: The issue is related to the lack of necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has a low impact on...

PT-2025-20817 · Sap · Sap Gui For Windows

Name of the Vulnerable Software and Affected Versions: SAP GUI for Windows affected versions not specified Description: The issue allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store user credentials. This may have a Low impact on th...

PT-2025-20821 · Sap · Sap Service Parts Management

Name of the Vulnerable Software and Affected Versions: SAP Service Parts Management SPM affected versions not specified Description: The issue is related to the lack of necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has a low impact on...

PT-2025-20810 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver affected versions not specified Description: The issue is caused by the injection of malicious instructions into user configuration settings, allowing an attacker with administrative privileges to expose sensitive information su...

PT-2025-20815 · Sap · Sap S/4Hana

Name of the Vulnerable Software and Affected Versions: SAP S/4 HANA affected versions not specified Description: The issue allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field, potentially...

SAP Data Services Management Console 跨站脚本漏洞

SAP Data Services Management Console is a console for managing and monitoring data services. A cross-site scripting vulnerability exists in SAP Data Services Management Console that stems from the system failing to adequately encode user-controlled input. An attacker could exploit the vulnerabili...

SAP Business Objects Business Intelligence Platform 安全漏洞

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. An access control error vulnerability exists in SAP Business Objects...

PT-2025-20806

Name of the Vulnerable Software and Affected Versions SAP Supplier Relationship Management SRM affected versions not specified Description The issue concerns the use of a deprecated java applet component within the Live Auction Cockpit in SAP SRM. This allows an unauthenticated attacker to craft ...

PT-2025-20814 · Sap · Sap S4Core

Name of the Vulnerable Software and Affected Versions: SAP S4CORE affected versions not specified Description: The issue allows an authenticated attacker to access restricted information due to a missing authorization check in the OData meta-data property. This could cause a low impact on...

PT-2025-20805

Name of the Vulnerable Software and Affected Versions SAP Supplier Relationship Management SRM affected versions not specified Description The Live Auction Cockpit in SAP Supplier Relationship Management SRM uses a deprecated Java applet component, allowing an unauthenticated attacker to execute...

CVE-2025-43006: Improper Neutralization of Input During Web Page Generation

SAP Supplier Relationship Management Master Data Management Catalogue allows an unauthenticated attacker to execute malicious scripts in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application, but it can have som...

CVE-2025-30012: Deserialization of Untrusted Data

The Live Auction Cockpit in SAP Supplier Relationship Management SRM uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload request in a specific encoding format. The servlet will then decode this malicious request which will result in...

SAP NetWeaver Visual Composer Metadata Uploader 安全漏洞

SAP NetWeaver Visual Composer Metadata Uploader is a component in SAP NetWeaver for uploading metadata. A deserialization vulnerability exists in SAP NetWeaver Visual Composer Metadata Uploader that originates from deserializing malicious content, which can be exploited by an attacker to cause a...

CVE-2025-42999

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system. Recent assessments: Assessed Attacker...