SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-42965Server Side Request Forgery(SSRF) vulnerability in SAP BusinessObjects BI Platform Central Management Console Promotion Management Application
- CVE-2025-42964Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration
- CVE-2025-42963Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer )
- CVE-2025-42962Cross-Site Scripting (XSS) vulnerability in SAP Business Warehouse (Business Explorer Web 3.5 loading animation)
- CVE-2025-42961Missing Authorization check in SAP NetWeaver Application Server for ABAP
- CVE-2025-42960Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA BEx Tools
- CVE-2025-42959Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476
- CVE-2025-42954Denial of service (DOS) in SAP NetWeaver Business Warehouse (CCAW application)
- CVE-2025-42953Missing Authorization check in SAP NetWeaver Application Server for ABAP
- CVE-2025-42952Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis
- CVE-2025-31326HTML Injection vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
- CVE-2025-42998Security misconfiguration vulnerability in SAP Business One Integration Framework
- CVE-2025-42996Multiple vulnerabilities in SAP MDM Server
- CVE-2025-42995Multiple vulnerabilities in SAP MDM Server
- CVE-2025-42994Multiple vulnerabilities in SAP MDM Server
- CVE-2025-42993Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement)
- CVE-2025-42991Missing Authorization check in SAP S/4HANA (Bank Account Application)
- CVE-2025-42990HTML Injection in Unprotected SAPUI5 applications
- CVE-2025-42989Missing Authorization check in SAP NetWeaver Application Server for ABAP
- CVE-2025-42988Server-Side Request Forgery in SAP Business Objects Business Intelligence Platform
- CVE-2025-42987Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement)
- CVE-2025-42984Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application)
- CVE-2025-42983Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis
- CVE-2025-42982Information Disclosure in SAP GRC (AC Plugin)
- CVE-2025-42977Directory Traversal vulnerability in SAP NetWeaver Visual Composer
- CVE-2025-31325Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver (ABAP Keyword Documentation)
- CVE-2025-23192Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (BI Workspace)
- CVE-2025-43011Missing Authorization Check in SAP Landscape Transformation (PCL Basis)
- CVE-2025-43010Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))
- CVE-2025-43009Missing Authorization check in SAP Service Parts Management (SPM)