SAP NetWeaver Metadata Uploader RCE (CVE-2025-31324)

Exploits CVE-2025-31324 unauthenticated file upload via SAP NetWeaver Visual Composer Metadata Uploader to deploy a JSP webshell and execute a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Visual Composer Metadata Uploader RCE CVE-2025-31324.""" import re import...

CVE-2025-42999: Deserialization of Untrusted Data

SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...

CVE-2025-31324: Unrestricted Upload of File with Dangerous Type

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availabili...