[ Vendor · 21 CVEs ]
SAP
CVEs affecting SAP published in the last 30 days, plus any SAP CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2025-42999 | 13 May 2025 | CVSS 9.1 | SAP NetWeaver DeserializationSAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when… | Exploited |
| CVE-2025-31324 | 24 Apr 2025 | CVSS 9.8 | SAP NetWeaver Unrestricted File UploadSAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially… | Exploited |
| CVE-2022-22536 | 9 Feb 2022 | CVSS 10.0 | SAP Multiple Products HTTP Request SmugglingSAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are… | Exploited |
| CVE-2021-38163 | 14 Sep 2021 | CVSS 8.8 | SAP NetWeaver Unrestricted File UploadSAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user… | Exploited |
| CVE-2020-6287 | 14 Jul 2020 | CVSS 10.0 | SAP NetWeaver Missing Authentication for Critical FunctionSAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker… | Exploited |
| CVE-2020-6207 | 10 Mar 2020 | CVSS 9.8 | SAP Solution Manager Missing Authentication for Critical FunctionSAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a… | Exploited |
| CVE-2019-0344 | 14 Aug 2019 | CVSS 9.8 | SAP Commerce Cloud Deserialization of Untrusted DataDue to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to… | Exploited |
| CVE-2019-0344 | 14 Aug 2019 | CVSS 9.8 | SAP Commerce Cloud Deserialization of Untrusted DataDue to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to… | Exploited |
| CVE-2018-2380 | 1 Mar 2018 | CVSS 6.6 | SAP Customer Relationship Management (CRM) Path TraversalSAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus… | Exploited |
| CVE-2017-12637 | 7 Aug 2017 | CVSS 7.5 | SAP NetWeaver Directory TraversalDirectory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote… | Exploited |
| CVE-2017-12637 | 7 Aug 2017 | CVSS 7.5 | SAP NetWeaver Directory TraversalDirectory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote… | Exploited |
| CVE-2016-9563 | 23 Nov 2016 | CVSS 6.5 | SAP NetWeaver XML External Entity (XXE)BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the… | Exploited |
| CVE-2016-9563 | 23 Nov 2016 | CVSS 6.5 | SAP NetWeaver XML External Entity (XXE)BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the… | Exploited |
| CVE-2010-5326 | 13 May 2016 | CVSS 10.0 | SAP NetWeaver Remote Code ExecutionThe Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote… | Exploited |
| CVE-2010-5326 | 13 May 2016 | CVSS 10.0 | SAP NetWeaver Remote Code ExecutionThe Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote… | Exploited |
| CVE-2016-3976 | 7 Apr 2016 | CVSS 7.5 | SAP NetWeaver Directory TraversalDirectory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot… | Exploited |
| CVE-2016-3976 | 7 Apr 2016 | CVSS 7.5 | SAP NetWeaver Directory TraversalDirectory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot… | Exploited |
| CVE-2016-2388 | 16 Feb 2016 | CVSS 5.3 | SAP NetWeaver Information DisclosureThe Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP… | Exploited |
| CVE-2016-2388 | 16 Feb 2016 | CVSS 5.3 | SAP NetWeaver Information DisclosureThe Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP… | Exploited |
| CVE-2016-2386 | 16 Feb 2016 | CVSS 9.8 | SAP NetWeaver SQL InjectionSQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via… | Exploited |
| CVE-2016-2386 | 16 Feb 2016 | CVSS 9.8 | SAP NetWeaver SQL InjectionSQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via… | Exploited |