CVE-2025-26655: Missing Authorization

SAP Just In TimeJIT does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted...

CVE-2025-26660: Authorization Bypass Through User-Controlled Key

SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to...

PT-2025-10669

Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform Web Intelligence affected versions not specified Description The issue concerns a deprecated web application endpoint that is not properly secured, allowing an attacker to inject a malicious U...

CVE-2025-27436: Authorization Bypass Through User-Controlled Key

The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact with a resource is legitimate, allowing the attacker to delete the attachment of a posted bank statement. This leads to a low impact on...

PT-2025-10663

Name of the Vulnerable Software and Affected Versions SAP Web Dispatcher and Internet Communication Manager affected versions not specified Description The issue allows an attacker with administrative privileges to enable debugging trace mode with a specific parameter value, exposing unencrypted...

CVE-2025-26658: Session Fixation

The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify...

PT-2025-10681

Name of the Vulnerable Software and Affected Versions SAP S/4HANA affected versions not specified Description The issue in SAP S/4HANA is related to insufficient access control checks in the Manage Bank Statements function. This allows an authenticated user to potentially delete attachments of...

PT-2025-10673

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description The issue is related to a DOM-based Cross-Site Scripting XSS vulnerability. It occurs because the software does not sufficiently encode user-controlled inputs...

PT-2025-10676

Name of the Vulnerable Software and Affected Versions SAP CRM and SAP S/4HANA Interaction Center affected versions not specified Description The issue allows an attacker with low privileges to access restricted information under certain conditions. This is due to an SSRF flaw that enables the...

CVE-2025-0062: Improper Neutralization of Input During Web Page Generation

SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impac...

PT-2025-10674

Name of the Vulnerable Software and Affected Versions SAP Fiori affected versions not specified Description The issue arises from inadequate security settings configuration during the setup process of SAP Fiori applications that utilize the posting library. This allows an attacker with low...

SAP Business One authorization issue vulnerabilities

SAP Business One is a suite of business management software from the German company SAP. The software includes functionality for financial management, operations management, and human resource management. SAP Business One suffers from an authorization issue vulnerability that stems from improper...

SAP Business Objects Business Intelligence Platform Cross-site Scripting Vulnerability

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. SAP Business Objects Business Intelligence Platform suffers from a cross-site scripting vulnerability that stems from the application's lack of effective...

CVE-2025-27433: Authorization Bypass Through User-Controlled Key

The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application's integrity, with no effect on confidentiality and...

PT-2025-10664

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform affected versions not specified Description The issue is related to improper error handling, which reveals technical details of the application in exceptions and stack traces. An attacker wit...

CVE-2025-26661: Missing Authorization

Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...

PT-2025-10675

Name of the Vulnerable Software and Affected Versions SAP NetWeaver ABAP Class Builder affected versions not specified Description The issue is due to a missing authorization check, allowing an attacker to escalate privileges and gain higher access levels. This could result in the disclosure of...

CVE-2025-27434: Improper Neutralization of Input During Web Page Generation

Due to insufficient input validation, SAP Commerce Swagger UI allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting XSS attack. This could lead to a high impact on the confidentiality, integrity...

CVE-2025-0071: Insertion of Sensitive Information into Log File

SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter value. This exposes unencrypted passwords in the logs, causing a high impact on the confidentiality of the application. There is no impac...

CVE-2025-27432: Missing Authorization

The eDocument Cockpit Inbound NF-e in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized access to each transaction. By executing the specific ABAP method within the ABAP system, an unauthorized attacker could call each transaction an...