Sap
608 CVEs across 553 Sap products. Browse Sap vulnerabilities, severities, and proof-of-concept exploits.
Sap products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27680 | Low | 3.1 | 2026-05-14 | Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS)… |
CVE-2026-40135 | Medium | 6.5 | 2026-05-12 | An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that allows an authenticated attacker with admi… |
CVE-2026-27682 | Medium | 4.7 | 2026-05-12 | Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages), an unauthen… |
CVE-2026-34264 | Medium | 6.5 | 2026-04-14 | During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages. Due to this, an authenticated user with low… |
CVE-2026-34262 | Medium | 5.0 | 2026-04-14 | Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer |
CVE-2026-34257 | Medium | 6.1 | 2026-04-14 | Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a vi… |
CVE-2026-27679 | Medium | 6.5 | 2026-04-14 | Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities… |
CVE-2026-27674 | Medium | 6.1 | 2026-04-14 | Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that i… |
CVE-2026-27688 | Medium | 5.0 | 2026-03-10 | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer… |
CVE-2026-24316 | Medium | 6.4 | 2026-03-10 | SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external en… |
CVE-2026-24310 | Low | 3.5 | 2026-03-10 | Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read… |
CVE-2026-24309 | Medium | 6.4 | 2026-03-10 | Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read… |
CVE-2026-24314 | Medium | 4.3 | 2026-02-24 | Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This co… |
CVE-2026-24328 | Medium | 6.1 | 2026-02-10 | SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when clicked by a victim, redirect them to atta… |
CVE-2026-24327 | Medium | 4.3 | 2026-02-10 | Due to missing authorization check in SAP Strategic Enterprise Management (Balanced Scorecard in Business Server Pages), an authenticated attacker could access… |
CVE-2026-24326 | Medium | 4.3 | 2026-02-10 | Due to a missing authorization check in the Disconnected Operations of the SAP S/4HANA Defense & Security, an attacker with user privileges could call remote-e… |
CVE-2026-24325 | Medium | 4.8 | 2026-02-10 | SAP BusinessObjects Enterprise does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an… |
CVE-2026-24324 | Medium | 6.5 | 2026-02-10 | SAP BusinessObjects Business Intelligence Platform (AdminTools) allows an authenticated attacker with user privileges to execute a specific query in AdminTools… |
CVE-2026-24323 | Medium | 6.1 | 2026-02-10 | The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. W… |
CVE-2026-24322 | High | 7.7 | 2026-02-10 | SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing sensit… |
CVE-2026-24321 | Medium | 5.3 | 2026-02-10 | SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive info… |
CVE-2026-24320 | Low | 3.1 | 2026-02-10 | Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memor… |
CVE-2026-24319 | Medium | 5.8 | 2026-02-10 | In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could pote… |
CVE-2026-24312 | Medium | 5.2 | 2026-02-10 | An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass role restrictions by l… |
CVE-2026-23689 | High | 7.7 | 2026-02-10 | Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can re… |
CVE-2026-23688 | Medium | 4.3 | 2026-02-10 | SAP Fiori App Manage Service Entry Sheets does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Thi… |
CVE-2026-23687 | High | 8.8 | 2026-02-10 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modif… |
CVE-2026-23686 | Low | 3.4 | 2026-02-10 | Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially cra… |
CVE-2026-23685 | Medium | 4.4 | 2026-02-10 | Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially c… |
CVE-2026-23684 | Medium | 5.9 | 2026-02-10 | A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being… |
CVE-2026-23681 | Medium | 4.3 | 2026-02-10 | Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retri… |
CVE-2026-0509 | Critical | 9.6 | 2026-02-10 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the re… |
CVE-2026-0508 | High | 7.3 | 2026-02-10 | The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Up… |
CVE-2026-0505 | Medium | 6.1 | 2026-02-10 | The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unval… |
CVE-2026-0490 | High | 7.5 | 2026-02-10 | SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication… |
CVE-2026-0488 | Critical | 9.9 | 2026-02-10 | An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critica… |
CVE-2026-0486 | Medium | 5.0 | 2026-02-10 | In ABAP based SAP systems a remote enabled function module does not perform necessary authorization checks for an authenticated user resulting in disclosure of… |
CVE-2026-0485 | High | 7.5 | 2026-02-10 | SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to c… |
CVE-2026-0484 | Medium | 6.5 | 2026-02-10 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code… |
CVE-2026-0514 | Medium | 6.1 | 2026-01-13 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious link. When an unsuspecting use… |
CVE-2026-0513 | Medium | 4.7 | 2026-01-13 | Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a maliciou… |
CVE-2026-0506 | High | 8.1 | 2026-01-13 | Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to exec… |
CVE-2026-0500 | Critical | 9.6 | 2026-01-13 | Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malici… |
CVE-2026-0498 | Critical | 9.1 | 2026-01-13 | SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This fla… |
CVE-2026-0492 | High | 8.8 | 2026-01-13 | SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining a… |
CVE-2025-42894 | Medium | 6.8 | 2025-11-11 | Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrit… |
CVE-2025-42893 | Medium | 6.1 | 2025-11-11 | Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirec… |
CVE-2025-42892 | Medium | 6.8 | 2025-11-11 | Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could… |
CVE-2025-42886 | Medium | 6.1 | 2025-11-11 | Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it… |
CVE-2025-42926 | Medium | 5.3 | 2025-09-09 | SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Up… |
CVE-2025-42920 | Medium | 6.1 | 2025-09-09 | Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and… |
CVE-2025-42918 | Medium | 4.3 | 2025-09-09 | SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameter… |
CVE-2025-42911 | Medium | 5.0 | 2025-09-09 | SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to information about the… |
CVE-2025-42936 | Medium | 5.4 | 2025-08-12 | The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allo… |
CVE-2025-42956 | Medium | 6.1 | 2025-07-08 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. W… |
CVE-2025-42986 | Medium | 4.3 | 2025-07-08 | Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Func… |
CVE-2025-42968 | Medium | 5.0 | 2025-07-08 | SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information… |
CVE-2025-42988 | Low | 3.7 | 2025-06-10 | Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal ne… |
CVE-2025-23192 | High | 8.2 | 2025-06-10 | SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the vi… |
CVE-2025-42999 | Critical | 9.1 | 2025-05-13 | SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could… |
CVE-2025-30018 | High | 8.6 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a craft… |
CVE-2025-30012 | Critical | 10.0 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to sen… |
CVE-2025-30011 | Medium | 5.3 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-30010 | Medium | 6.1 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-30009 | Medium | 6.1 | 2025-05-13 | he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-31324 | Critical | 10.0 | 2025-04-24 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious ex… |
CVE-2025-31332 | Medium | 6.6 | 2025-04-08 | Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files poten… |
CVE-2025-25245 | Medium | 5.4 | 2025-03-11 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured. An attacker… |
CVE-2025-23193 | Medium | 5.3 | 2025-02-11 | SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of… |
CVE-2025-0064 | High | 8.7 | 2025-02-11 | Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to gen… |
CVE-2025-0066 | Critical | 9.9 | 2025-01-14 | Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due… |
CVE-2025-0063 | High | 8.8 | 2025-01-14 | SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with ba… |
CVE-2025-0061 | High | 8.7 | 2025-01-14 | SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interactio… |
CVE-2025-0060 | Medium | 6.5 | 2025-01-14 | SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive inf… |
CVE-2025-0058 | Medium | 6.5 | 2025-01-14 | In SAP Business Workflow and SAP Flexible Workflow, an authenticated attacker can manipulate a parameter in an otherwise legitimate resource request to view se… |
CVE-2025-0053 | Medium | 5.3 | 2025-01-14 | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL param… |
CVE-2024-32732 | Medium | 5.3 | 2024-12-10 | Under certain conditions SAP BusinessObjects Business Intelligence platform allows an attacker to access information which would otherwise be restricted.This h… |
CVE-2024-47595 | Medium | 6.3 | 2024-11-12 | An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacke… |
CVE-2024-47594 | Medium | 5.4 | 2024-10-08 | SAP NetWeaver Enterprise Portal (KMC) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An a… |
CVE-2024-45282 | Medium | 4.3 | 2024-10-08 | Fields which are in 'read only' state in Bank Statement Draft in Manage Bank Statements application, could be modified by MERGE method. The property of an ODat… |
CVE-2024-45278 | Medium | 5.4 | 2024-10-08 | SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. After successful exploitati… |
CVE-2024-45277 | Medium | 4.3 | 2024-10-08 | The SAP HANA Node.js client package versions from 2.0.0 before 2.21.31 is impacted by Prototype Pollution vulnerability allowing an attacker to add arbitrary p… |
CVE-2024-37179 | High | 7.7 | 2024-10-08 | SAP BusinessObjects Business Intelligence Platform allows an authenticated user to send a specially crafted request to the Web Intelligence Reporting Server to… |
CVE-2024-45281 | Medium | 5.8 | 2024-09-10 | SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally s… |
CVE-2024-44112 | Medium | 4.3 | 2024-09-10 | Due to missing authorization check in SAP for Oil & Gas (Transportation and Distribution), an attacker authenticated as a non-administrative user could call a… |
CVE-2024-41728 | Low | 2.7 | 2024-09-10 | Due to missing authorization check, SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker logged in as a developer to read objects con… |
CVE-2024-44114 | Low | 2.0 | 2024-09-10 | SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This resu… |
CVE-2024-42373 | Medium | 4.3 | 2024-08-13 | SAP Student Life Cycle Management (SLcM) fails to conduct proper authorization checks for authenticated users, leading to the potential escalation of privilege… |
CVE-2024-41734 | Medium | 4.3 | 2024-08-13 | Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction… |
CVE-2024-39591 | Medium | 4.3 | 2024-08-13 | SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact o… |
CVE-2024-42377 | Medium | 4.3 | 2024-08-13 | SAP shared service framework allows an authenticated non-administrative user to call a remote-enabled function, which will allow them to insert value entries i… |
CVE-2024-42376 | Medium | 6.5 | 2024-08-13 | SAP Shared Service Framework does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. On successful exp… |
CVE-2024-42375 | Medium | 4.3 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by th… |
CVE-2024-42374 | High | 8.2 | 2024-08-13 | BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information… |
CVE-2024-41737 | Medium | 5.0 | 2024-08-13 | SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On… |
CVE-2024-41736 | Medium | 4.3 | 2024-08-13 | Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on th… |
CVE-2024-41735 | Medium | 5.4 | 2024-08-13 | SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confid… |
CVE-2024-41733 | Medium | 5.3 | 2024-08-13 | In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a giv… |
CVE-2024-41732 | Medium | 4.7 | 2024-08-13 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web app… |
CVE-2024-41731 | Low | 3.1 | 2024-08-13 | SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker to upload malicious code over the network, that could be executed by the ap… |