SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-43008Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal
- CVE-2025-43007Missing Authorization check in SAP Service Parts Management (SPM)
- CVE-2025-43006Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)
- CVE-2025-43005Information Disclosure vulnerability in SAP GUI for Windows
- CVE-2025-43004Security Misconfiguration Vulnerability in SAP Digital Manufacturing (Production Operator Dashboard)
- CVE-2025-43003Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise)
- CVE-2025-43002Missing Authorization check in SAP S4/HANA (OData meta-data property)
- CVE-2025-43000Information Disclosure Vulnerability in SAP Business Objects Business Intelligence Platform (PMW)
- CVE-2025-42999Insecure Deserialization in SAP NetWeaver (Visual Composer development server)
- CVE-2025-42997Information Disclosure vulnerability in SAP Gateway Client
- CVE-2025-31329Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
- CVE-2025-30018Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
- CVE-2025-30012Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
- CVE-2025-30011Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
- CVE-2025-30010Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
- CVE-2025-30009Multiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)
- CVE-2025-26662Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console
- CVE-2025-31324Missing Authorization check in SAP NetWeaver (Visual Composer development server)
- CVE-2025-31328Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)
- CVE-2025-31327OData meta-data property entity tampering in SAP Field Logistics
- CVE-2025-31333Odata meta-data tampering in SAP S4CORE entity
- CVE-2025-31332Insecure File permissions vulnerability in SAP BusinessObjects Business Intelligence Platform
- CVE-2025-31331Authorization Bypass vulnerability in SAP NetWeaver
- CVE-2025-31330Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
- CVE-2025-30017Missing Authorization check in SAP Solution Manager
- CVE-2025-30016Authentication Bypass Vulnerability in SAP Financial Consolidation
- CVE-2025-30015Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)
- CVE-2025-30014Directory Traversal vulnerability in SAP Capital Yield Tax Management
- CVE-2025-30013Code Injection vulnerability in SAP ERP BW Business Content
- CVE-2025-27437Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface)