SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-42908Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP
- CVE-2025-42906Directory Traversal vulnerability in SAP Commerce Cloud
- CVE-2025-42903User Enumeration and Sensitive Data Exposure via RFC Function in SAP Financial Service Claims Management
- CVE-2025-42902Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform
- CVE-2025-42901Code Injection vulnerability in SAP Application Server for ABAP (BAPI Browser)
- CVE-2025-42907Server-Side Request Forgery in SAP BI Platform
- CVE-2025-42958Missing Authentication check in SAP NetWeaver
- CVE-2025-42944Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)
- CVE-2025-42938Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform
- CVE-2025-42933Insecure Storage of Sensitive Information in SAP Business One (SLD)
- CVE-2025-42930Denial of Service (DoS) vulnerability in SAP Business Planning and Consolidation
- CVE-2025-42929Missing input validation vulnerability in SAP Landscape Transformation Replication Server
- CVE-2025-42927Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)
- CVE-2025-42926Missing Authentication check in SAP NetWeaver Application Server Java
- CVE-2025-42925Predictable Object Identifier vulnerability in SAP NetWeaver AS Java (IIOP Service)
- CVE-2025-42923Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (F4044 Manage Work Center Groups)
- CVE-2025-42922Insecure File Operations vulnerability in SAP NetWeaver AS Java (Deploy Web Service)
- CVE-2025-42920Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management
- CVE-2025-42918Missing Authorization check in SAP NetWeaver Application Server for ABAP (Background Processing)
- CVE-2025-42917Missing Authorization check in SAP HCM (Approve Timesheets Fiori 2.0 application)
- CVE-2025-42916Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
- CVE-2025-42915Missing Authorization Check in Fiori app (Manage Payment Blocks)
- CVE-2025-42914Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)
- CVE-2025-42913Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)
- CVE-2025-42912Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)
- CVE-2025-42911Missing Authorization check in SAP NetWeaver (Service Data Download)
- CVE-2025-42976Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document)
- CVE-2025-42975Multiple vulnerabilities in SAP NetWeaver Application Server ABAP (BIC Document)
- CVE-2025-42957Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
- CVE-2025-42955Missing authorization check in SAP Cloud Connector