EUVD-2026-72583

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

CVE-2026-76963 Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

CVE-2026-66768

SAP GUI for Java (part of SAP NetWeaver) contains an Improper Access Control flaw where the trust level policy is not correctly enforced for certain functions invoked from a connected backend system. A low-privileged attacker can manipulate a connected backend to trigger affected functionality, e...

CVE-2026-66768 Improper Access Control in SAP NetWeaver (SAP GUI for Java)

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

CVE-2026-66767 Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

CVE-2026-66767 Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

CVE-2026-66767

CVE-2026-66767 is a memory corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an unauthenticated user to send a specially crafted packet triggering reprocessing of a previously buffered user request , potentially hijacking another user's session un...

EUVD-2026-72576

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

EUVD-2026-72575

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

CVE-2026-58240 Missing Authentication check in SAP NetWeaver (Message Server)

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

CVE-2026-58240

SAP NetWeaver Message Server fails to sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the service can register an unauthorized component and potentially perform unauthorized actions within the...

CVE-2026-58240 Missing Authentication check in SAP NetWeaver (Message Server)

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

PT-2026-86950

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

PT-2026-86951

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

PT-2026-86958

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

CVE-2020-6287_RECON-scanner

CVE-2020-6287 RECON 취약점 평가 및 침해 지표IoC 스캐너 RECONRemotely Exploitable Code On NetWeaver은 SAP NetWeaver Java 스택 위에서 실행되는 여러 SAP 비즈니스 및 기술 애플리케이션에 영향을 미치는 심각한CVSSv3 10 취약점입니다. 이 취약점은 Onapsis Research Labs에서 발견되었으며, SAP와 긴밀히 협력하여 2020년 7월 14일에 패치를 개발 및 출시했습니다. 이 문제의 심각성을 고려하여 미국 DHS CISA, BSI CERT-Bun...

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536

SAP-memory-pipes-desynchronization-vulnerability-MPI-CVE-2022-22536 この脆弱性は何ですか？ SAP NetWeaver Application Server ABAP、SAP NetWeaver Application Server Java、ABAP Platform、SAP Content Server 7.53、およびSAP Web...

CVE-2016-2386

CVE-2016-2386 SAP NetWeaver AS JAVA UDDI Component SQL Injection root@kitploit: POST /UDDISecurityService/UDDISecurityImplBean HTTP/1.1 Host: host Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78....

sap_netweaver_cve-2025-31324-

This repository does not have a README...

CVE-2025-31324_PoC

CVE-2025-31324PoC CVE-2025-31324에 대한 개념 증명: SAP NetWeaver Visual Composer Metadata Uploader의 인증되지 않은 업로드 이 스크립트는 다음을 수행합니다: 1. 취약한 엔드포인트에 파일 업로드 Upload 호스트/포트를 통해 2. HTTP GET을 통한 선택적 트리거 Trigger 호스트/포트를 통해 3. 기본 응답 검증/로깅 사용 예시: python3 PoC.py --host sap.example.com --port 50000 --endpoint...