Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2026-27688

Missing Authorization check in SAP NetWeaver Application Server for ABAP

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Abap Netweaver Application Server For Abap
CVE-2025-42989

Missing Authorization check in SAP NetWeaver Application Server for ABAP

RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server For Abap
CVE-2026-24310

Missing Authorization check in SAP NetWeaver Application Server for ABAP

Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read the sensitive information from database catalog of the ABAP system. This vulnerability has low impact on the application's confidentiality with no effect on the integrity and availability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Abap Netweaver Application Server For Abap
CVE-2026-24316

Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP

SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is no impact on availability of the application.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Abap Netweaver Application Server For Abap
CVE-2026-24309

Missing Authorization check in SAP NetWeaver Application Server for ABAP

Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized content change could lead to reduced system performance or interruptions. The vulnerability has low impact on the application's integrity and availability, with no effect on confidentiality.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server Abap Netweaver Application Server For Abap
CVE-2025-42976

Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document)

SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, could cause a memory corruption error. On successful exploitation, this results in the crash of the target component. Multiple submissions can make the target completely unavailable. A similarly crafted submission can be used to perform an out-of-bounds read operation as well, revealing sensitive information that is loaded in memory at that time. There is no ability to modify any information.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Netweaver Application Server For Abap
CVE-2025-42901

Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)

SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when accessing the affected functionality of BAPI explorer. This has low impact on confidentiality and integrity with no impact on availability of the application.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Application Server Netweaver Application Server For Abap Sap Web Application Server
CVE-2025-42908

Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP

Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allow the attacker to perform actions and execute transactions that would normally require specific permissions, compromising the integrity and confidentiality of the system by enabling unauthorized access to restricted functionality. There is no impact to availability from this vulnerability.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server For Abap
CVE-2025-42942

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP

SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could access and modify limited information within the scope of victim's browser. This vulnerability has no impact on availability of the application.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server For Abap
CVE-2025-42961

Missing Authorization check in SAP NetWeaver Application Server for ABAP

Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient validation of user permissions to access sensitive database tables. By leveraging overly permissive access configurations, unauthorized reading of critical data is possible, resulting in a significant impact on the confidentiality of the information stored. However, the integrity and availability of the system remain unaffected.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server For Abap
CVE-2025-42882

Missing Authorization check in SAP NetWeaver Application Server for ABAP

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system could further assist this attacker to plan subsequent attacks. As a result, this vulnerability has a low impact on confidentiality, with no impact on the integrity or availability of the application.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Application Server Netweaver Netweaver Abap and 3 more
CVE-2025-42936

Missing Authorization check in SAP NetWeaver Application Server for ABAP

The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Netweaver Application Server For Abap Sap Basis