Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query.EPSS 0.3%Oct 13, 2026
- Critical10.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.EPSS 0.3%Oct 13, 2026
- Critical9.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality.EPSS 0.3%Oct 13, 2026
- Medium4.3Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data in…May 14, 2026
- Medium4.3SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access.May 12, 2026
- Medium6.5An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with administrati…May 12, 2026
- Medium6.1Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthenticated…May 12, 2026
- Medium6.5During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages.Apr 14, 2026
- Medium4.3Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database ExplorerApr 14, 2026
- Medium6.1Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, th…Apr 14, 2026
- Medium4.1SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs.Apr 14, 2026
- Medium6.5Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exp…Apr 14, 2026
- Medium6.1Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interp…Apr 14, 2026
- Medium5.0Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log File…Mar 10, 2026
- Medium5.8Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges could access sensitive data belonging to another company.Mar 10, 2026
- Medium5.9Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module.Mar 10, 2026
- Medium5.0SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application.Mar 10, 2026
- Medium6.4SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints.Mar 10, 2026
- Medium5.6The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms.Mar 10, 2026
- Medium4.3Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read the sen…Mar 10, 2026
- Medium6.4Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify…Mar 10, 2026
- Medium4.3Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted.Feb 24, 2026
- Critical9.1SAP NetWeaver Deserialization VulnerabilityKEVEPSS 12.7%May 12, 2025
- Critical9.8SAP NetWeaver Unrestricted File Upload VulnerabilityKEVEPSS 99.5%Apr 24, 2025
- Critical10.0SAP Multiple Products HTTP Request Smuggling VulnerabilityKEVEPSS 97.9%Feb 9, 2022
36 records · page 1 of 2
PreviousNext