PT-2025-32608 · Sap · Sap Netweaver/Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver ABAP Platform affected versions not specified Description: A Cross-Site Scripting XSS issue exists in SAP NetWeaver ABAP Platform. An unauthenticated attacker can create a malicious link and distribute it publicly. If an...

SAP NetWeaver Application Server ABAP 安全漏洞

SAP NetWeaver Application Server ABAP is a platform for running and developing applications based on the ABAP language from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server ABAP that stems from an improperly assigned authorization that could lead to elevated...

SAP Internet Communication Manager和SAP NetWeaver Application Server ABAP 日志信息泄露漏洞

SAP Internet Communication Manager SAP ICM and SAP NetWeaver Application Server ABAP are products of SAP, Germany.SAP Internet Communication Manager is an SAP SAP Internet Communication Manager is an SAP NetWeaver Application Server component. It is used to receive and send Web requests HTTP,...

PT-2025-32606 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP affected versions not specified Description: SAP NetWeaver Application Server ABAP is susceptible to an HTML injection issue. An attacker can construct a URL containing a malicious script as a payload,...

SAP NetWeaver ABAP Platform 跨站脚本漏洞

NetWeaver ABAP Platform is an enterprise-class application development and deployment platform provided by SAP. A cross-site scripting vulnerability exists in NetWeaver ABAP Platform. An attacker could use this vulnerability to generate a malicious link and make it publicly accessible. When an...

PT-2025-32601 · Sap · Abap Platform Internet Communication Manager +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager ICM affected versions not specified Description: The Internet Communication Manager ICM component allows authorized users with administrator privileges and...

SAP NetWeaver Application Server ABAP 代码注入漏洞

SAP NetWeaver Application Server ABAP is an application server developed by SAP to run ABAP applications. An HTML injection vulnerability exists in SAP NetWeaver Application Server ABAP. An attacker could exploit this vulnerability to construct URLs containing malicious scripts that could be...

SAP NetWeaver Vulnerability Used in Auto-Color Malware Attack on US Firm

Darktrace uncovers the first exploit of a critical SAP NetWeaver vulnerability CVE-2025-31324 to deploy Auto-Color backdoor malware. Learn how this evasive Linux RAT targets systems for remote code execution and how AI-powered defence thwarts multi-stage attacks...

SAP NetWeaver Visual Composer Metadata Uploader Installed

Binary data sapnwmduinstalled.nbin...

SAP Netweaver Visual Composer Insecure Deserialization (3604119)

SAP NetWeaver Visual Composer is affected by an insecure deserialization vulnerability caused by insufficient validation of uploaded content, when deserialized, provided by a high-privileged user. This allows an attacker to potentially compromise the confidentiality, integrity, and availability o...

SAP NetWeaver Application Server JAR Detection

Binary data sapnwlocaldetection.nbin...

SAP NetWeaver AS ABAP Multiple Vulnerabilities

The remote SAP NetWeaver ABAP server may be affected by multiple vulnerabilies. - SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious lin...

CVE-2025-42956

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, injected input data will be used by the web site page generation to create...

CVE-2025-42954

SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any input parameters, which results in reduced performance or interrupted operation of the affected resource. This leads to low impact on...

CVE-2025-42978

The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS server. This might lead to the outbound...

CVE-2025-42969

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The victim, when tricked into clicking on this crafted URL unknowingly executes the malicious payload in their browser. On successful exploitatio...

CVE-2025-42961

Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient validation of user permissions to access sensitive database tables. By leveraging overly permissive access configurations, unauthorized...

CVE-2025-42966

SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability ...

CVE-2025-42981

Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a victim clicks on this link, the script executes within the victim's browser, redirecting the...

CVE-2025-42964

SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system...