CVE-2025-26654 Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)

SAP Commerce Cloud Public Cloud does not allow to disable unencrypted HTTP port 80 entirely, but instead allows a redirect from port 80 to 443 HTTPS. As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request befor...

CVE-2025-26654 Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)

SAP Commerce Cloud Public Cloud does not allow to disable unencrypted HTTP port 80 entirely, but instead allows a redirect from port 80 to 443 HTTPS. As a result, Commerce normally communicates securely over HTTPS. However, the confidentiality and integrity of data sent on the first request befor...

CVE-2025-26653 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting XSS vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. When a user visits the compromised page,...

CVE-2025-26653 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting XSS vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. When a user visits the compromised page,...

CVE-2025-26653

SAP NetWeaver Application Server ABAP is affected by a Stored XSS due to insufficient encoding of user-controlled inputs. Affected component: SAP NetWeaver AS ABAP (applications based on SAP GUI for HTML). Impact: attacker can inject and execute malicious JavaScript in a victim’s browser, comprom...

CVE-2025-23186 Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely...

CVE-2025-23186 Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be further exploited to completely...

CVE-2025-23186

CVE-2025-23186 affects SAP NetWeaver Application Server ABAP. An authenticated attacker can craft an RFC request to restricted destinations, exposing credentials for a remote service and potentially fully compromising that remote service. Root cause cited in sources is improper access control aro...

PT-2025-15365 · Sap · Sap Commerce Cloud

Name of the Vulnerable Software and Affected Versions: SAP Commerce Cloud affected versions not specified Description: The issue affects the confidentiality and integrity of data sent in the first request before a redirect from HTTP to HTTPS. Normally, Commerce communicates securely over HTTPS, b...

PT-2025-15376 · Sap · Sap Landscape Transformation

Name of the Vulnerable Software and Affected Versions: SAP Landscape Transformation SLT affected versions not specified Description: The issue allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC, enabling the injection of arbitrary ABAP code...

PT-2025-15378 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform affected versions not specified Description: The issue is related to insecure file permissions in the SAP BusinessObjects Business Intelligence Platform. An attacker with local access to the...

PT-2025-15368 · Sap · Sap S/4Hana

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA affected versions not specified Description: The issue allows an attacker with user privileges to exploit a flaw in the function module exposed via RFC, enabling the injection of arbitrary ABAP code into the system and bypassing...

PT-2025-15366 · Sap · Sap Kmc Wpc

Name of the Vulnerable Software and Affected Versions: SAP KMC WPC affected versions not specified Description: The issue allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query, potentially exposing sensitive information and causing low impact on the...

PT-2025-15371 · Sap · Sap Erp Bw Business Content

Name of the Vulnerable Software and Affected Versions: SAP ERP BW Business Content affected versions not specified Description: The issue is related to OS Command Injection through certain function modules. When these modules are executed with elevated privileges, they improperly handle user inpu...

PT-2025-15373 · Sap · Sap Netweaver +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver and ABAP Platform Application Server ABAP affected versions not specified Description: The issue arises from incorrect memory address handling in ABAP SQL, allowing an authenticated attacker with high privileges to execute...

PT-2025-15372 · Sap · Sap Capital Yield Tax Management

Name of the Vulnerable Software and Affected Versions: SAP Capital Yield Tax Management affected versions not specified Description: The issue is related to a directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from...

SAP NetWeaver Application Server 代码注入漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A code injection vulnerability exists in SAP NetWeaver Application Server, which arises from improper authentication checks, where an attacker constructs a malicious RFC request to a restricted target. The vulnerability...

PT-2025-15375 · Sap · Sap Solution Manager

Name of the Vulnerable Software and Affected Versions: SAP Solution Manager version 7.1 Description: The issue is caused by a missing authorization check, allowing an authenticated attacker to upload a file as a template for solution documentation. This can lead to limited impact on the integrity...

PT-2025-15363 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP affected versions not specified Description: The issue allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, exposing credentials for a remote service...

SAP NetWeaver 缓冲区错误漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. SAP NetWeaver suffers from a buffer overflow vulnerability that stems from improper handling of memory addresses, which could allow an attacker to execute certain forms of SQL queries. An attack...