SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-42951Broken Authorization in SAP Business One (SLD)
- CVE-2025-42950Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
- CVE-2025-42949Missing Authorization check in ABAP Platform
- CVE-2025-42948Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform
- CVE-2025-42946Directory Traversal vulnerability in SAP S/4HANA (Bank Communication Management)
- CVE-2025-42945HTML Injection vulnerability in SAP NetWeaver Application Server ABAP
- CVE-2025-42943Information Disclosure in SAP GUI for Windows
- CVE-2025-42942Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server for ABAP
- CVE-2025-42941Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)
- CVE-2025-42936Missing Authorization check in SAP NetWeaver Application Server for ABAP
- CVE-2025-42935Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform(Internet Communication Manager)
- CVE-2025-42934CRLF Injection vulnerability in SAP S/4HANA (Supplier invoice)
- CVE-2025-42947Code Injection vulnerability in SAP FICA ODN framework
- CVE-2025-42956Multiple vulnerabilities in SAP NetWeaver Application Server ABAP
- CVE-2025-43001Multiple Privilege Escalation Vulnerabilities in SAPCAR
- CVE-2025-42992Multiple Privilege Escalation Vulnerabilities in SAPCAR
- CVE-2025-42986Missing Authorization check in SAP NetWeaver and ABAP Platform
- CVE-2025-42985Open Redirect vulnerability in SAP BusinessObjects Content Administrator workbench
- CVE-2025-42981Multiple vulnerabilities in SAP NetWeaver Application Server ABAP
- CVE-2025-42980Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network
- CVE-2025-42979Insecure Key & Secret Management vulnerability in SAP GUI for Windows
- CVE-2025-42978Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java
- CVE-2025-42974Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)
- CVE-2025-42973Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report)
- CVE-2025-42971Memory Corruption vulnerability in SAPCAR
- CVE-2025-42970Directory Traversal vulnerability in SAPCAR
- CVE-2025-42969Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
- CVE-2025-42968Missing Authorization check in SAP NetWeaver (RFC enabled function module)
- CVE-2025-42967Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation)
- CVE-2025-42966Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)