Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2025-24874

Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice

SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence, clickjacking could become possible then, and lead to exposure and modification of sensitive information.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Commerce Backoffice
CVE-2024-45278

Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice

SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap Sap Se
Products
Commerce Backoffice Sap Commerce Backoffice
CVE-2024-41735

Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice

SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confidentiality and integrity of the application.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Commerce Backoffice