PT-2026-70028

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP and ABAP Platform affected versions not specified Description An attacker with high privileges can bypass missing security controls on an internal code path, leading to operating system command execution...

PT-2026-70027

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java Adobe Document Service affected versions not specified Description The Adobe Document Service component uses outdated open source cryptographic and data transfer libraries. A low-privileged authenticated...

PT-2026-70019

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description An unauthenticated attacker can exploit logical errors in the parsing of the DIAG protocol, which is a proprietary SAP protocol used for communication between th...

PT-2026-70032

Name of the Vulnerable Software and Affected Versions SAP NetWeaver and ABAP Platform affected versions not specified Description In the Change and Transport System - Customer Transport Integration Wizard, a low-privileged user can modify configuration tables that control access to data objects...

SAP NetWeaver ICM Info page leak Detection

Detection of SAP NetWeaver ABAP Webserver /public/info page !/usr/bin/env python3 -- coding: utf-8 -- """Detection of SAP NetWeaver ABAP Webserver /public/info page.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion Detection

SAP xMII 15.0 for SAP NetWeaver 7.4 is susceptible to a local file inclusion vulnerability in the GetFileList function. This can allow remote attackers to read arbitrary files via a .. dot dot in the path parameter to /Catalog, aka SAP Security Note 2230978. !/usr/bin/env python3 -- coding: utf-8...

SAP NetWeaver CVE-2025-31324 Detection

Detects unauthenticated access to SAP NetWeaver Visual Composer Metadata Uploader CVE-2025-31324 without uploading a malicious payload. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Visual Composer CVE-2025-31324 unauth metadata uploader detection.""" from kittysploit import from...

CVE-2026-58246

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate...

CVE-2026-58246

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate...

CVE-2026-58246 Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate...

CVE-2026-58246: Exposure of Sensitive System Information to an Unauthorized Control Sphere

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow impersonation of legitimate...

SAP NetWeaver AS Java XSS in Configuration Wizard (3748227)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3748227: - SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafte...

SAP NetWeaver AS ABAP BSP XSS (3754659)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3754659: - Due to a Cross-Site Scripting XSS vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application...

SAP NetWeaver AS ABAP Memory Corruption (3747367)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3747367: - SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory...

ABAP Application Server Buffer Overflow

The vulnerability of the software used for developing and executing applications in the ABAP language on the SAP NetWeaver Application Server ABAP is related to writing beyond buffer boundaries. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access t...

SAP NetWeaver Enterprise Portal XSS (3746678)

The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a cross-site scripting vulnerability as referenced in SAP Security Note 3746678: - SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. T...

CVE-2026-44747

SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability. This has high impact on confidentiality, integrity, and...

CVE-2026-44752

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data...

CVE-2026-44759

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-44760 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)

Due to a Cross-Site Scripting XSS vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions...