CVE-2025-42975 Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document)

SAP NetWeaver Application Server ABAP BIC Document allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document application, embeds a malicious script. When a victim clicks on this link, the script executes in the victim's browser, allowing the attacker to acces...

CVE-2025-42975

CVE-2025-42975 concerns SAP NetWeaver Application Server ABAP (BIC Document). The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw that allows an attacker to craft a URL which, when opened in the BIC Document app, embeds a malicious script and, upon user interaction, executes i...

CVE-2025-42945 HTML Injection vulnerability in SAP NetWeaver Application Server ABAP

SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability could lead to limited access to data or it...

CVE-2025-42943 Information Disclosure in SAP GUI for Windows

SAP GUI for Windows may allow the leak of NTML hashes when specific ABAP frontend services are called with UNC paths. For a successful attack, the attacker needs developer authorization in a specific Application Server ABAP to make changes in the code, and the victim needs to execute by using SAP...

CVE-2025-42942 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP

SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could...

CVE-2025-42936

CVE-2025-42936 affects SAP NetWeaver Application Server for ABAP. The root cause is missing support for distinguishing authorizations across roles, allowing authenticated users to access restricted objects in the barcode interface and causing privilege escalation. Impact is described as low for c...

CVE-2025-42935

The CVE-2025-42935 entry concerns SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM). The vulnerability is an information disclosure where authorized users with admin privileges and local access can read sensitive information from log files, impacting con...

CVE-2025-42975: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server ABAP BIC Document allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document application, embeds a malicious script. When a victim clicks on this link, the script executes in the victim's browser, allowing the attacker to acces...

CVE-2025-42942: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could...

PT-2025-32606 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP affected versions not specified Description: SAP NetWeaver Application Server ABAP is susceptible to an HTML injection issue. An attacker can construct a URL containing a malicious script as a payload,...

CVE-2025-36000: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with...

SAP Internet Communication Manager and SAP NetWeaver Application Server ABAP log information leakage vulnerabilities

SAP Internet Communication Manager SAP ICM and SAP NetWeaver Application Server ABAP are products of SAP, Germany.SAP Internet Communication Manager is an SAP SAP Internet Communication Manager is an SAP NetWeaver Application Server component. It is used to receive and send Web requests HTTP,...

SAP NetWeaver Application Server ABAP code injection vulnerability

SAP NetWeaver Application Server ABAP is an application server developed by SAP to run ABAP applications. An HTML injection vulnerability exists in SAP NetWeaver Application Server ABAP. An attacker could exploit this vulnerability to construct URLs containing malicious scripts that could be...

SAP NetWeaver Application Server ABAP Cross-site Scripting Vulnerability

SAP NetWeaver Application Server ABAP is a platform for running and developing applications based on the ABAP language from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server ABAP BIC Document that stems from vulnerability to cross-site scripting attacks...

SAP NetWeaver Application Server ABAP buffer error vulnerability

SAP NetWeaver Application Server ABAP is a platform for running and developing applications based on the ABAP language from SAP, Germany. A buffer error vulnerability exists in SAP NetWeaver Application Server ABAP BIC Document that originates from a memory corruption error and could lead to a...

SAP NetWeaver Application Server ABAP security vulnerabilities

SAP NetWeaver Application Server ABAP is a platform for running and developing applications based on the ABAP language from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server ABAP that stems from an improperly assigned authorization that could lead to elevated...

CVE-2025-42976: Out-of-bounds Read

SAP NetWeaver Application Server ABAP BIC Document allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, could cause a memory corruption error. On successful exploitation, this results in the crash of the target component. Multiple submissions can...

CVE-2025-42945: Improper Control of Generation of Code

SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability could lead to limited access to data or it...

CVE-2025-42935: Insertion of Sensitive Information into Log File

The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager ICM permits authorized users with admin privileges and local access to log files to read sensitive information, resulting in information disclosure. This leads to high impact on the confidentiality of the...

CVE-2025-36124: Privilege Chaining

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration...