CVE-2024-39592

CVE-2024-39592 concerns SAP PDCE missing authorization checks for authenticated users, enabling privilege escalation and read-access to sensitive data. Affected component: PDCE; root cause: lack of necessary authorization controls. Impact: high confidentiality risk (per CVSS and multiple sources)...

CVE-2023-29110

The CVE-2023-29110 issue affects SAP Application Interface (Message Dashboard) across multiple releases: AIF 703, AIFX 702, S4CORE 100/101, SAP_BASIS 755/756, SAP_ABA 75C/75D/75E. The root cause is that the application allows unrestricted HTML markup, enabling an authorized attacker to use basic ...

CVE-2021-33701

CVE-2021-33701 affects SAP NetWeaver/DMIS components (e.g., SAP DMIS 2011_1_731 SP0013) via a remote SQL injection in the NDZT tool used by S/4HANA and the DMIS mobile plug-in. The root cause is an injection in the IUUC_RECON_RC_COUNT_TABLE_BIG/related query surface, enabling an attacker with hig...

CVE-2018-2419

CVE-2018-2419 concerns SAP Enterprise Financial Services (SAPSCORE 1.11/1.12; S4CORE 1.01/1.02; EA-FINSERV 6.x, 8.0) where an authenticated user can escalate privileges due to missing authorization checks. The description and related sources corroborate a privilege-escalation flaw without detaili...

CVE-2024-37172

CVE-2024-37172 affects SAP S/4HANA Finance (Advanced Payment Management). The issue is an insufficient authorization check for an authenticated user, enabling privilege escalation. Impact is described as low for confidentiality and availability, with no effect on integrity. No exploitation status...

CVE-2023-35870

Summary : CVE-2023-35870 affects SAP S/4HANA, specifically the Manage Journal Entry Template in the S4CORE 104–107 stack. An attacker could intercept the save request for a journal entry template and modify it, exposing confidentiality and integrity of the resource. Additionally, a standard templ...

CVE-2018-2484

CVE-2018-2484 (SAP Enterprise Financial Services) is a privilege-escalation vulnerability caused by a failure to perform necessary authorization checks for an authenticated user. The affected stack includes SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15), S4CORE (1.01–1.03)...

CVE-2023-29109

CVE-2023-29109 affects SAP Application Interface Framework (Message Dashboard) across AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755/756, SAP_ABA 75C/75D/75E. The root cause is an Excel formula injection in fields such as the Tooltip of the Custom Hints List, which can execute when the victim opens...

CVE-2023-32112

CVE-2023-32112 affects SAP Vendor Master Hierarchy: SAP_APPL 500–618 and S4CORE 100 expose a missing authorization check in Vendor Master Hierarchy functions, allowing an authenticated user to modify data and potentially impact integrity. Root cause: inadequate authorization validation for certai...

CVE-2023-40625

CVE-2023-40625 involves the SAP S4CORE Manage Purchase Contracts App where versions 102–107 do not perform necessary authorization checks for authenticated users, enabling potential privilege escalation. Connected source PT-2023-27547 corroborates the affected versions and notes remediation: upgr...

CVE-2026-0505

CVE-2026-0505 affects BSP applications where unauthenticated users can manipulate user-controlled URL parameters that are not sufficiently validated, resulting in unvalidated redirects to attacker-controlled websites. Root cause: insufficient validation of URL parameters. Impact per provided metr...

CVE-2026-23688

CVE-2026-23688 affects SAP Fiori App Manage Service Entry Sheets. The issue is insufficient authorization checks for an authenticated user, enabling privilege escalation with low impact to integrity; confidentiality and availability are unaffected. CVSS 3.1 vector yields a base score of 4.3 (MEDI...

CVE-2026-24323

CVE-2026-24323 affects BSP applications of SAP Document Management System. An unauthenticated user can inject malicious script via user-controlled URL parameters that are not sufficiently sanitized, causing script execution in the victim’s browser. Impact is described as low for confidentiality a...