SAP Solution Manager Directory Traversal Vulnerability

SAP Solution Manager is a set of system monitoring, SAP support desktop, self-service, ASAP implementation and other functions of the German SAP company as a system management platform. A directory traversal vulnerability exists in SAP Solution Manager, which stems from a lack of validity checkin...

SAP Netweaver Unauthorized Access Vulnerability

SAP NetWeaver is SAP's integrated technology platform. An unauthorized access vulnerability exists in SAP Netweaver that stems from an authorization check bypass and can be exploited by an attacker to gain unauthorized access to ABAP code...

PT-2025-36544

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver affected versions not specified Description: SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, potentially granting access to information about the SAP system and operatin...

SAP Capital Yield Tax Management Directory Traversal Vulnerability

SAP Capital Yield Tax Management is a tool for capital gains tax calculation, reporting and compliance management from SAP. A directory traversal vulnerability exists in SAP Capital Yield Tax Management, which can be exploited by an attacker to submit a special request to view the contents of...

SAP Commerce Cloud Information Disclosure Vulnerability (CNVD-2025-07505)

SAP Commerce Cloud is a set of cloud-based e-commerce platform from Germany's SAP. The product supports sales management, marketing management, order management and operations management. An information disclosure vulnerability exists in SAP Commerce Cloud, which can be exploited by an attacker t...

SAP ERP BW Business Content Code Injection Vulnerability

SAP ERP BW Business Content is a cloud-based e-commerce platform that helps companies create a personalized and seamless buying experience for their customers. SAP ERP BW Business Content suffers from a code injection vulnerability that can be exploited by an attacker to execute arbitrary code...

SAP NetWeaver AS ABAP Authorization Bypass (3565944)

The remote SAP NetWeaver ABAP server may be affected by an authorization bypass vulnerability. Due to incorrect memory address handling in ABAP SQL of SAP NetWeaver and ABAP Platform Application Server ABAP, an authenticated attacker with high privileges could execute certain forms of SQL queries...

SAP NetWeaver AS ABAP Access Control (3554667)

The remote SAP NetWeaver ABAP server may be affected by an access control vulnerability. In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, which can be used to expose credentials fo...

SAP NetWeaver AS ABAP Authorization Bypass Vulnerability

The remote SAP NetWeaver ABAP server may be affected by an authorization bypass vulnerability. SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once logged into the ABAP system, the...

SAP S/4HANA RFC Code Execution

The vulnerability of the functional module of the SAP S/4HANA software platform’s RFC interface is related to improper code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary ABAP code remotely and gain unauthorized access to the system...

SAP NetWeaver AS ABAP XSS (3559307)

The remote SAP NetWeaver ABAP server may be affected by an information disclosure vulnerability. SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting XSS vulnerability. This enables an attacker, without requiring any...

SAP NetWeaver AS ABAP Access Control (3568778)

The remote SAP NetWeaver ABAP server may be affected by an access control vulnerability. A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authenticated as a non-administrative user can initiate...

CVE-2025-30017

Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application...

CVE-2025-30013

SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handle user input, allowing attacker to inject arbitrary OS commands. This vulnerability allows the execution of unintende...

CVE-2025-27435

Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow the attacker to use the disclosed coupon code, hence posing a low impact on confidentiality and...

CVE-2025-27437

A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authenticated as a non-administrative user can initiate a transaction, allowing them to access but not modify non-sensitive data without further...

CVE-2025-31332

Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity and availability. However, this...

CVE-2025-31333

SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker causing low impact on integrity of the application. Confidentiality and availability is not impacted...

CVE-2025-31331

SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once logged into the ABAP system, the attacker can run a specific transaction that exposes sensitive system code without proper...

CVE-2025-26657

SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability...