The vulnerability of the functional module of the SAP S/4HANA software platform’s RFC interface allows a perpetrator to execute arbitrary code.

The vulnerability of the functional module of the SAP S/4HANA software platform’s RFC interface is related to improper code generation management. Exploiting this vulnerability allows an attacker to execute arbitrary ABAP code remotely and gain unauthorized access to the system...

WordPress Deliver via Shipos for WooCommerce Plugin <= 2.1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Deliver via Shipos for WooCommerce versions = 2.1.7...

CVE-2025-27429

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating...

WordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Sync Posts versions = 1.0...

CVE-2025-21595

A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause an FPC to crash, leading to Denial of Service DoS. On all Junos OS and Junos OS Evolved...

CVE-2025-27429

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating...

CVE-2025-27429 Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating...

CVE-2025-27429

CVE-2025-27429 concerns SAP S/4HANA where a user-authenticated attacker can abuse a RFC-exposed function module to inject arbitrary ABAP code, bypassing authorization checks and potentially gaining full system compromise. The root cause is code injection via the RFC interface, enabling impact to ...

PT-2025-15368 · Sap · Sap S/4Hana

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA affected versions not specified Description: The issue allows an attacker with user privileges to exploit a flaw in the function module exposed via RFC, enabling the injection of arbitrary ABAP code into the system and bypassing...

inigo-rs (>=0.1.5 <=0.27.8) potentially affected by CVE-2025-32032 via apollo-router (=1.2.1)

apollo-router CARGO version =1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on apollo-router and may be impacted: - inigo-rs =0.1.5, =0.27.8 Source cves: CVE-2025-32032 Source advisory: OSV:GHSA-94HH-JMQ8-2FGP...

VulnCheck KEV: CVE-2021-36276

Dell DBUtilDrv2.sys driver versions 2.5 and 2.6 contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required...

WordPress plugin Musician s Pack for Elementor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Tenda W6-S setcfm function buffer overflow vulnerability

Tenda W6-S is a 300Mbps wireless panel AP designed for large households such as homes, hotels and villas to provide stable wireless network coverage and low latency network experience. The Tenda W6-S suffers from a buffer overflow vulnerability that originates from the setcfm function failing to...

WordPress PDF Generator Addon for Elementor Page Builder plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin PDF Generator Addon for Elementor Page Builder versions = 2.1.0...

CVE-2025-28221

Tenda W6S v1.0.0.4510 has a Buffer Overflow vulnerability in the setlocaltime function, which allows remote attackers to cause web server crash via parameter time passed to the binary through a POST request...

Tenda W6 安全漏洞

Tenda W6S is a wireless router. The Tenda W6S suffers from a buffer overflow vulnerability that originates when the setlocaltime function does not validate the length of the time parameter when processing the time parameter passed via a POST request, resulting in a buffer overflow that can be...

Unspecified Vulnerability in SAP S/4HANA (CNVD-2025-08314)

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP, Germany. A security vulnerability exists in SAP S/4HANA that stems from a lack of authorization checking, which could be exploited by an attacker to gain unauthorized access to...

SAP CRM and SAP S/4HANA server-side request forgery vulnerability (CNVD-2025-07595)

SAP CRM and SAP S/4HANA are both products of SAP, a customer relationship management system, and SAP S/4HANA, an enterprise resource management software based on the SAP HANA in-memory database system. SAP CRM and SAP S/4HANA suffer from a server-side request forgery vulnerability, which stems fr...

aact-openhands (>=0.0.4 <=0.0.5), aberoth-ephemeris (>=1.0.0 <=1.0.2) +580 more potentially affected by CVE-2024-6844 via flask-cors (>=1.1.2 <=5.0.1)

flask-cors PYPI version =1.1.2, =0.0.4, =1.0.0, =1.8.8, =1.1.4, =0.0.1, =0.0.1, =0.0.4, =0.0.13, =0.1.0, =0.1.1, =0.1.0, =1.1.0, =0.0.1, =0.0.18, =1.0.2, =1.3.0 and more Source cves: CVE-2024-6844 Source advisory: OSV:GHSA-8VGW-P6QM-5GR7...

CVE-2024-55594

An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker to execute unauthorized code or commands via HTTP/S crafted requests...