SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-24875SameSite Defense in Depth not applied for some cookies in SAP Commerce
- CVE-2025-24874Missing Defense in Depth Against Clickjacking in SAP Commerce Backoffice
- CVE-2025-24872Missing Authorization check in SAP ABAP Platform (ABAP Build Framework)
- CVE-2025-24870Insecure Key & Secret Management vulnerability in SAP GUI for Windows
- CVE-2025-24869Information Disclosure vulnerability in SAP NetWeaver Application Server Java
- CVE-2025-24868Open Redirect Vulnerability in SAP HANA extended application services, advanced model (User Account and Authentication Services)
- CVE-2025-24867Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence platform (BI Launchpad)
- CVE-2025-23193Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP
- CVE-2025-23191Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP
- CVE-2025-23190Missing Authorization check in SAP NetWeaver and ABAP platform (ST-PI)
- CVE-2025-23189Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)
- CVE-2025-23187Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN)
- CVE-2025-0064Improper Authorization in SAP BusinessObjects Business Intelligence platform (Central Management Console)
- CVE-2025-0054Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java
- CVE-2025-0070Improper Authentication in SAP NetWeaver ABAP Server and ABAP Platform
- CVE-2025-0069DLL Hijacking vulnerability in SAPSetup
- CVE-2025-0068Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
- CVE-2025-0067Missing Authorization check in SAP NetWeaver Application Server Java
- CVE-2025-0066Information Disclosure vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)
- CVE-2025-0063SQL Injection vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2025-0061Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform
- CVE-2025-0060Multiple vulnerabilities in SAP BusinessObjects Business Intelligence Platform
- CVE-2025-0059Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
- CVE-2025-0058Information Disclosure vulnerability in SAP Business Workflow and SAP Flexible Workflow
- CVE-2025-0057Cross-Site Scripting vulnerability in SAP NetWeaver AS JAVA (User Admin Application)
- CVE-2025-0056Information Disclosure vulnerability in SAP GUI for Java
- CVE-2025-0055Information Disclosure vulnerability in SAP GUI for Windows
- CVE-2025-0053Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2024-54198Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
- CVE-2024-54197Server-Side Request Forgery in SAP NetWeaver Administrator (System Overview)