CVE-2025-42977 Directory Traversal vulnerability in SAP NetWeaver Visual Composer

SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. This allows an attacker to read or modify arbitrary files, resulting in a high impact on confidentiality and a low impact on integrity...

CVE-2025-42977

CVE-2025-42977 concerns SAP NetWeaver Visual Composer and is a directory-traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. The affected component is the SAP NetWeaver Visual Composer environment; the underlying issue is improper input pat...

CVE-2025-31325 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver (ABAP Keyword Documentation)

Due to a Cross-Site Scripting vulnerability in SAP NetWeaver ABAP Keyword Documentation, an unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a victim accesses the affected page, the script executes in their browser, providing the...

CVE-2025-31325

SAP NetWeaver ABAP Keyword Documentation is affected by a Cross-Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject JavaScript into a vulnerable page via an unprotected parameter, causing the script to run in the victim's browser and potentially access restricted informatio...

CVE-2025-31325 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver (ABAP Keyword Documentation)

Due to a Cross-Site Scripting vulnerability in SAP NetWeaver ABAP Keyword Documentation, an unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a victim accesses the affected page, the script executes in their browser, providing the...

SAP NetWeaver 跨站脚本漏洞

SAP NetWeaver is a service-oriented integrated application platform from SAP. The platform primarily provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP NetWeaver, which stems from a cross-site scripting vulnerability that could...

SAP NetWeaver Visual Composer 路径遍历漏洞

SAP NetWeaver Visual Composer is a graphical modeling environment in the SAP NetWeaver platform for rapid development and deployment of composite applications. A directory traversal vulnerability exists in SAP NetWeaver Visual Composer, which stems from insufficient input path validation, and can...

PT-2025-24584 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver affected versions not specified Description: The issue is related to a Cross-Site Scripting vulnerability. An unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a...

SAP NetWeaver 安全漏洞

SAP NetWeaver is a set of integrated service-oriented application platforms from SAP, Germany. The platform primarily provides a development and runtime environment for SAP applications. A security vulnerability exists in SAP NetWeaver that stems from insufficient authorization checking and could...

PT-2025-24585 · Sap · Sap Netweaver Visual Composer

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Visual Composer affected versions not specified Description: The issue is caused by insufficient validation of input paths provided by a high-privileged user, allowing an attacker to read or modify arbitrary files. This results ...

PT-2025-24591 · Sap · Sap Netweaver

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server for ABAP affected versions not specified Description: The issue is related to a missing authorization check in the RFC inbound processing, allowing an authenticated user to escalate their privileges. This coul...

VulnCheck KEV: CVE-2016-2389

Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence xMII component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. dot dot in the Path parameter to /Catalog, aka SAP Security Note 2230978...

The vulnerability of the SAP NetWeaver Application ABAP software integration platform’s server, related to improper code generation management, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the SAP NetWeaver Application ABAP software integration platform is related to incorrect code generation management. Exploiting this vulnerability allows an attacker to influence the confidentiality, integrity, and accessibility of protected information...

China-Linked Hackers Exploit SAP and SQL Server Flaws in Attacks Across Asia and Brazil

The China-linked threat actor behind the recent in-the-wild exploitation of a critical security flaw in SAP NetWeaver has been attributed to a broader set of attacks targeting organizations in Brazil, India, and Southeast Asia since 2023. "The threat actor mainly targets the SQL injection...

SAP NetWeaver Information Disclosure Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. An information disclosure vulnerability exists in SAP NetWeaver, which can be exploited by an attacker to...

CVE-2025-0057

SAP NetWeaver AS JAVA User Admin Application is vulnerable to stored cross site scripting vulnerability. An attacker posing as an admin can upload a photo with malicious JS content. When a victim visits the vulnerable component, the attacker can read and modify information within the scope of...

CVE-2025-0053

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of...

CVE-2025-0067

Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on...

CVE-2025-0068

An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application...

CVE-2024-47594

SAP NetWeaver Enterprise Portal KMC does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An attacker could craft a script and trick the user into clicking it. When a victim who is registered on the portal clicks on such link,...