Lucene search
+L

17875 matches found

Kitploit
Kitploit
added 2026/09/20 7:03 p.m.10 views

SAPGateBreaker-Exploit

CVE-2022-22536: HTTP Smuggling Through SAP's Front Door SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepe...

10CVSS8.5AI score0.97945EPSS
SaveExploits8
Kitploit
Kitploit
added 2026/09/20 6:16 p.m.6 views

CVE-2025-31324

🔴 CVE-2025-31324 — SAP NetWeaver Visual Composer Unauthenticated File Upload Type: Proof of Concept — Vulnerability Research CVE: CVE-2025-31324 CVSS: 10.0 Critical AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Status: Patched — SAP Security Note 3594142 + 3604119 Added to CISA KEV: May 2025 ⚠️ Este PoC...

10CVSS8.6AI score0.9947EPSS
SaveExploits19
Kitploit
Kitploit
added 2026/09/20 1:15 p.m.8 views

CVE-2025-31324

CVE-2025-31324 A proof of concept developed to exploit CVE-2025-31324. Usage root@kitploit: usage: python CVE-2025-31324.py --help SAP NetWeaver Visual Composer Metadata Uploader = 7.50 CVE-2025-31324 PoC positional arguments: FILE local file to upload optional arguments: -h, --help show this hel...

10CVSS8.4AI score0.9947EPSS
SaveExploits19References1
Kitploit
Kitploit
added 2026/09/20 10:47 a.m.9 views

Burp_CVE-2025-31324

CVE-2025-31324 Burp Suite Extension Overview This Python-based Burp Suite extension is designed to detect the presence of CVE-2025-31324 , a critical vulnerability in SAP NetWeaver Visual Composer’s Metadata Uploader component. The vulnerability allows unauthenticated remote code execution via fi...

10CVSS8.7AI score0.9947EPSS
SaveExploits19
Kitploit
Kitploit
added 2026/09/20 10:25 a.m.14 views

CVE-2025-31324

Proof of Concept - CVE-2025-31324 [email protected] Proof of concept exploit for vulnerability CVE-2025-31324 in SAP NetWeaver Visual Composer , which allows arbitrary file upload without authentication via the /developmentserver/metadatauploader endpoint. ⚠️ This code is for educational...

10CVSS8.9AI score0.9947EPSS
SaveExploits19
Kitploit
Kitploit
added 2026/09/20 7:19 a.m.39 views

HoneySAP

HoneySAP: SAP Low-interaction honeypot Version 0.1.2.dev0 XXX 2022 Overview HoneySAP is a low-interaction research-focused honeypot specific for SAP services. It's aimed at learn the techniques and motivations behind attacks against SAP systems. Features low-interaction honeypot for SAP services...

6AI score
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.142 views

SAP Internet Graphics Server (IGS) - XML External Entity Injection

SAP Internet Graphics Servers IGS running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag...

7.5CVSS7.2AI score0.38736EPSS
SaveExploits2References6
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.41 views

SAP Solution Manager - Open Redirect

SAP Solution Manager contains an open redirect vulnerability via the logoff endpoint. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-26836 info: name: SAP Solution Manager - Open...

6.1CVSS6AI score0.022EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.282 views

SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting

SAP Knowledge Warehouse 7.30, 7.31, 7.40, and 7.50 contain a reflected cross-site scripting vulnerability via the usage of one SAP KW component within a web browser. id: CVE-2021-42063 info: name: SAP Knowledge Warehouse =7.5.1 to mitigate the XSS vulnerability. reference: -...

6.1CVSS7AI score0.22224EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.220 views

SAP Solution Manager 7.2 - Remote Command Execution

SAP Solution Manager SolMan running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet tcsmdagentapplicationeem. The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information...

10CVSS8.5AI score0.98266EPSS
SaveExploits7References7
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.59 views

SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion

SAP xMII 15.0 for SAP NetWeaver 7.4 is susceptible to a local file inclusion vulnerability in the GetFileList function. This can allow remote attackers to read arbitrary files via a .. dot dot in the path parameter to /Catalog, aka SAP Security Note 2230978. id: CVE-2016-2389 info: name: SAP xMII...

7.8CVSS7.4AI score0.20424EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.159 views

SAP Web Application Server 6.x/7.0 - Open Redirect

frameset.htm in the BSP runtime in SAP Web Application Server WAS 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter. id: CVE-2005-3634 info: name: SAP Web...

5CVSS6AI score0.17757EPSS
SaveExploits2References6
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.185 views

SCIMono <0.0.19 - Remote Code Execution

SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and execute java expressions and compromise the availability and integrity of the system. id: CVE-2021-21479 info: name: SCIMono 0.0.19 - Remote Code Execution author: dwisiswant0 severit...

9.1CVSS8AI score0.10116EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/19 3:43 p.m.11 views

CVE-2025-31324

CVE-2025-31324 Proof-of-Concept 0day for SAP NetWeaver created by ShinyHunters CVE-2025-31324 is a critical "Unrestricted File Upload" vulnerability affecting the SAP NetWeaver Application Server AS Java. Specifically, it resides within the Visual Composer component VCFRAMEWORK. The flaw allows a...

10CVSS8.5AI score0.9947EPSS
SaveExploits19
Kitploit
Kitploit
added 2026/09/19 10:11 a.m.9 views

SAPSlayer

This repository does not have a README...

5.7AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/19 4:18 a.m.11 views

CVE-2025-42944

CVE-2025-42944 Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution,...

10CVSS8.8AI score0.02893EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.211 views

SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

9.9CVSS7.8AI score0.69075EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.290 views

SAP Memory Pipes (MPI) Desynchronization

SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation attacks. An unauthenticated attacker can prepend a victim's request with arbitrary data. This...

10CVSS9.1AI score0.97945EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.153 views

SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

SAP BusinessObjects Business Intelligence Platform Web Services 410, 420, and 430 is susceptible to blind server-side request forgery. An attacker can inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful...

5.3CVSS6.7AI score0.61736EPSS
SaveExploits3References5
Kitploit
Kitploit
added 2026/09/18 6:13 p.m.10 views

sap_bo_launchpad-ssrf-timing_attack

SAP BusinessObjects Launchpad SSRF & タイミング攻撃 PoC このPythonスクリプトは、SAP BusinessObjects Launchpadに対するSSRF(サーバーサイドリクエストフォージェリ)およびタイミング攻撃を実行するための概念実証(PoC)です。セキュリティ研究者や専門家がSAP BusinessObjectsの認証メカニズムを利用して、ターゲットIP上のオープンポートを特定するのに役立つように設計されています。 特徴 SSRF Exploit:...

6AI score
SaveExploits0
Rows per page
Query Builder