SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite Extension Overview This Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324 , a critical vulnerability in SAP NetWeaver Visual Composer’s Metadata Uploader component. The vulnerability allows unauthenticated remote code execution via fi...

CVE-2020-6286

CVE-2020-6286 SAP NetWeaver AS JAVA LM Configuration Wizard Directory Traversal SAP NetWeaver is SAP’s integrated technology platform and the technical foundation of all SAP applications since SAP Business Suite. SAP NetWeaver is a service-oriented application and integration platform that provid...

CVE-2018-2380

CVE-2018-2380 CVSS v3 Base Score: 6.6/10 PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM Script usage example python crmrce-CVE-2018-2380.py --host 127.0.0.1 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true Where --host is a SAP server...

CVE-2017-12637_SAP-NetWeaver-URL-Traversal

CVE-2017-12637SAP-NetWeaver-URL-Traversal Proof-of-concept LFI Scanner: Automated detection of /etc/passwd exposures via directory traversal and regex matching. LFI Scanner A lightweight Python proof-of-concept to scan target hosts for Local File Inclusion LFI vulnerabilities by attempting to...

Onapsis-Mandiant-CVE-2025-31324-Vuln-Compromise-Assessment

CVE-2025-31324 Zero-Day SAP Vulnerability & Compromise Assessment Tool Joint Release by Onapsis & Mandiant Onapsis and Mandiant have collaborated to release an open-source tool to assist SAP customers in identifying potential compromise related to CVE-2025-31324 and CVE-2025-42999 , a critical...

CVE-2020-6287-Sap-Add-User

CVE-2020-6287-Sap-Add-User sap netweaver portal add user administrator...

CVE-2016-2386

CVE-2016-2386 SAP NetWeaver AS JAVA UDDI Component SQL Injection POST /UDDISecurityService/UDDISecurityImplBean HTTP/1.1 Host: host Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78.0 Content-Type:...

CVE-2021-33690

CVE-2021-33690 CVE-2021-33690 Server Side Request Forgery vulnerability in SAP NetWeaver Development Infrastructure Application: SAP NetWeaver AS Java Versions Affected: SAP NetWeaver Development Infrastructure Component Build Service versions – 7.11, 7.20, 7.30, 7.31, 7.40, 7.50 Vendor URL:...

Onapsis_CVE-2025-31324_Scanner_Tools

Vulnerability and Indicator of Compromise IoC Scanner for CVE-2025-31324 Visual Composer Metadata Uploader Vulnerability CVE-2025-31324 is a critical CVSSv3 10 vulnerability affecting SAP NetWeaver systems, specifically within the Visual Composer Metadata Uploader component. This vulnerability...

CVE-2022-22536

CVE-2022-22536 SAP memory pipes desynchronization vulnerabilityMPI CVE-2022-22536. Description - POC for CVE-2022-22536: SAP memory pipesMPI desynchronization vulnerability. - create by antx at 2022-02-15. Detail SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP...

CVE-2025-31324

Info ░█▄█░█▀█░█░█░█░█░█░█░▀█▀░█▀█░█▀█░█▀▄░█░█ ░█░█░█▀▀░█░█░█░█░█▄█░░█░░█░█░█░█░█▀▄░░█░ ░▀░▀░▀░░░▀▀▀░▀▀▀░▀░▀░▀▀▀░▀░▀░▀░▀░▀░▀░░▀░ N U L L T R A C E // NullTrace :: No logs. No noise. Just signal. // ----- SIGNATURE----- Key: ssh-rsa AAAAB3...NullKey...KFA== Fingerprint:...

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536 What is the vulnerability about? SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request...

CVE-2020-6287

CVE-2020-6287 SAP NetWeaver AS JAVA LM Configuration Wizard Authentication Bypass Create Simple & Administrator Java User SAP NetWeaver is SAP’s integrated technology platform and the technical foundation of all SAP applications since SAP Business Suite. SAP NetWeaver is a service-oriented...

SAP-brute

SAP-brute SAP Netweaver Login Bruteforcer. usage: SAP-brute.py -h -u URL -f FILE -p PROXY optional arguments: -h, --help show this help message and exit -u URL, --url URL URL to test -f FILE, --file FILE File of urls -p PROXY, --proxy PROXY Proxy for debugging Single Site python3 SAP-brute.py -u...

CVE-2025-31324

🔴 CVE-2025-31324 — SAP NetWeaver Visual Composer Unauthenticated File Upload Type: Proof of Concept — Vulnerability Research CVE: CVE-2025-31324 CVSS: 10.0 Critical AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Status: Patched — SAP Security Note 3594142 + 3604119 Added to CISA KEV: May 2025 ⚠️ This PoC...

CVE-2025-31324

CVE-2025-31324 A proof of concept developed to exploit CVE-2025-31324. Usage usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this help message and...

CVE-2020-6287_RECON-scanner

Vulnerability Assessment and Indicator of Compromise IoC Scanner for CVE-2020-6287 RECON RECON Remotely Exploitable Code On NetWeaver is a critical CVSSv3 10 vulnerability affecting a number of SAP business and technical applications running on top of the SAP NetWeaver Java stack. This...

sap-netweaver-0day-CVE-2025-31324

The SUPERGROUP known as Scattered Lapsus$ Hunters - A combination of groups among ShinyHunters, Scattered Spider, and Lapsus$ have leaked the POC to this 0day This 0day was created by ShinyHunters and stolen from the Chinese state actors in active exploitation. Leaked here:...

jsp-webshell-scanner

JSP Webshell Scanner for SAP CVE-2025-31324 and PeopleSoft IOC Triage A lightweight script to scan .jsp and .jspx files for suspicious patterns typically associated with JSP-based webshells, including those observed in attacks exploiting SAP NetWeaver CVE-2025-31324. This scanner has also been...