SAP SE
Page 3 of 7 — SAP SE CVEs from a corpus of 624, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-42885 | Medium | 5.8 | 2025-11-11 | Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled function that will enable them to view informa… |
CVE-2025-42884 | Medium | 6.5 | 2025-11-11 | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enab… |
CVE-2025-42883 | Low | 2.7 | 2025-11-11 | Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges… |
CVE-2025-42882 | Medium | 4.3 | 2025-11-11 | Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific fun… |
CVE-2025-42939 | Medium | 4.3 | 2025-10-14 | SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of… |
CVE-2025-42937 | Critical | 9.8 | 2025-10-14 | SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent… |
CVE-2025-42910 | Critical | 9.0 | 2025-10-14 | Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These fil… |
CVE-2025-42909 | Low | 3.0 | 2025-10-14 | SAP Cloud Appliance Library Appliances allows an attacker with high privileges to leverage an insecure S/4HANA default profile setting in an existing SAP CAL a… |
CVE-2025-42908 | Medium | 5.4 | 2025-10-14 | Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions di… |
CVE-2025-42906 | Medium | 5.3 | 2025-10-14 | SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses wh… |
CVE-2025-42903 | Medium | 4.3 | 2025-10-14 | A vulnerability in SAP Financial Service Claims Management RFC function ICL_USER_GET_NAME_AND_ADDRESS allows user enumeration and potential disclosure of perso… |
CVE-2025-42902 | Medium | 5.3 | 2025-10-14 | Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP… |
CVE-2025-42901 | Medium | 5.4 | 2025-10-14 | SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim user's browser when a… |
CVE-2025-42907 | Medium | 4.3 | 2025-09-23 | SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server… |
CVE-2025-42958 | Critical | 9.1 | 2025-09-09 | Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modi… |
CVE-2025-42944 | Critical | 10.0 | 2025-09-09 | Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious… |
CVE-2025-42938 | Medium | 6.1 | 2025-09-09 | Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it p… |
CVE-2025-42933 | High | 8.8 | 2025-09-09 | When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of s… |
CVE-2025-42930 | Medium | 6.5 | 2025-09-09 | SAP Business Planning and Consolidation allows an authenticated standard user to call a function module by crafting specific parameters that causes a loop, con… |
CVE-2025-42929 | High | 8.1 | 2025-09-09 | Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables ar… |
CVE-2025-42927 | Low | 3.4 | 2025-09-09 | SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities… |
CVE-2025-42926 | Medium | 5.3 | 2025-09-09 | SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Up… |
CVE-2025-42925 | Medium | 4.3 | 2025-09-09 | Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could pr… |
CVE-2025-42923 | Medium | 4.3 | 2025-09-09 | Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to send unintended reques… |
CVE-2025-42922 | Critical | 9.9 | 2025-09-09 | SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This fil… |
CVE-2025-42920 | Medium | 6.1 | 2025-09-09 | Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and… |
CVE-2025-42918 | Medium | 4.3 | 2025-09-09 | SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameter… |
CVE-2025-42917 | Medium | 6.5 | 2025-09-09 | SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileg… |
CVE-2025-42916 | High | 8.1 | 2025-09-09 | Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables ar… |
CVE-2025-42915 | Medium | 5.4 | 2025-09-09 | Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abuse functionalities t… |
CVE-2025-42914 | Low | 3.1 | 2025-09-09 | Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate pri… |
CVE-2025-42913 | Low | 3.1 | 2025-09-09 | Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate pri… |
CVE-2025-42912 | Medium | 6.5 | 2025-09-09 | SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Th… |
CVE-2025-42911 | Medium | 5.0 | 2025-09-09 | SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to information about the… |
CVE-2025-42976 | High | 8.1 | 2025-08-12 | SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, co… |
CVE-2025-42975 | Medium | 6.1 | 2025-08-12 | SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document applicatio… |
CVE-2025-42957 | Critical | 9.9 | 2025-08-12 | SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbit… |
CVE-2025-42955 | Low | 3.5 | 2025-08-12 | Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted request to the endpoin… |
CVE-2025-42951 | High | 8.8 | 2025-08-12 | Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the correspondi… |
CVE-2025-42950 | Critical | 9.9 | 2025-08-12 | SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables… |
CVE-2025-42949 | Medium | 4.9 | 2025-08-12 | Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common tr… |
CVE-2025-42948 | Medium | 6.1 | 2025-08-12 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publi… |
CVE-2025-42946 | Medium | 6.9 | 2025-08-12 | Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction… |
CVE-2025-42945 | Medium | 6.1 | 2025-08-12 | SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a… |
CVE-2025-42943 | Medium | 4.5 | 2025-08-12 | SAP GUI for Windows may allow the leak of NTML hashes when specific ABAP frontend services are called with UNC paths. For a successful attack, the attacker nee… |
CVE-2025-42942 | Medium | 6.1 | 2025-08-12 | SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with mali… |
CVE-2025-42941 | Low | 3.5 | 2025-08-12 | SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link (<a>) elements. An attac… |
CVE-2025-42936 | Medium | 5.4 | 2025-08-12 | The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allo… |
CVE-2025-42935 | Medium | 4.1 | 2025-08-12 | The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privileges and local acces… |
CVE-2025-42934 | Medium | 4.3 | 2025-08-12 | SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into t… |
CVE-2025-42947 | Medium | 5.5 | 2025-07-23 | SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could… |
CVE-2025-43001 | Medium | 6.9 | 2025-07-08 | SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or process extracting th… |
CVE-2025-42992 | Medium | 6.9 | 2025-07-08 | SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to exploit critical files… |
CVE-2025-42986 | Medium | 4.3 | 2025-07-08 | Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Func… |
CVE-2025-42985 | Medium | 6.1 | 2025-07-08 | Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a vict… |
CVE-2025-42981 | Medium | 6.1 | 2025-07-08 | Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script… |
CVE-2025-42980 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialize… |
CVE-2025-42979 | Medium | 5.6 | 2025-07-08 | The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credential… |
CVE-2025-42978 | Low | 3.5 | 2025-07-08 | The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used… |
CVE-2025-42974 | Medium | 4.3 | 2025-07-08 | Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable acces… |
CVE-2025-42973 | Medium | 5.4 | 2025-07-08 | Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associate… |
CVE-2025-42971 | Medium | 4.0 | 2025-07-08 | A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicio… |
CVE-2025-42970 | Medium | 5.8 | 2025-07-08 | SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive containing directo… |
CVE-2025-42969 | Medium | 6.1 | 2025-07-08 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The vic… |
CVE-2025-42968 | Medium | 5.0 | 2025-07-08 | SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information… |
CVE-2025-42967 | Critical | 9.9 | 2025-07-08 | SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new… |
CVE-2025-42966 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerabil… |
CVE-2025-42965 | Medium | 4.1 | 2025-07-08 | SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configurat… |
CVE-2025-42964 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could p… |
CVE-2025-42963 | Critical | 9.1 | 2025-07-08 | A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deseri… |
CVE-2025-42962 | Medium | 6.1 | 2025-07-08 | SAP Business Warehouse (Business Explorer Web) allows an attacker to create a malicious link. If an authenticated user clicks on this link, the injected script… |
CVE-2025-42961 | Medium | 4.9 | 2025-07-08 | Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient va… |
CVE-2025-42960 | Medium | 4.3 | 2025-07-08 | SAP Business Warehouse and SAP BW/4HANA BEx Tools allow an authenticated attacker to gain higher access levels than intended by exploiting improper authorizati… |
CVE-2025-42959 | High | 8.1 | 2025-07-08 | An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific secur… |
CVE-2025-42954 | Low | 2.7 | 2025-07-08 | SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any… |
CVE-2025-42953 | High | 8.1 | 2025-07-08 | SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could… |
CVE-2025-42952 | High | 7.7 | 2025-07-08 | SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially ren… |
CVE-2025-31326 | Medium | 4.1 | 2025-07-08 | SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user privileges to injec… |
CVE-2025-42998 | Medium | 5.3 | 2025-06-10 | The security settings in the SAP Business One Integration Framework are not adequately checked, allowing attackers to bypass the 403 Forbidden error and access… |
CVE-2025-42996 | Medium | 5.6 | 2025-06-10 | SAP MDM Server allows an attacker to gain control of existing client sessions and execute certain functions without having to re-authenticate giving the abilit… |
CVE-2025-42995 | High | 7.5 | 2025-06-10 | SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that… |
CVE-2025-42994 | High | 7.5 | 2025-06-10 | SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server proces… |
CVE-2025-42993 | Medium | 6.7 | 2025-06-10 | Due to a missing authorization check vulnerability in SAP S/4HANA (Enterprise Event Enablement), an attacker with access to the Inbound Binding Configuration c… |
CVE-2025-42991 | Medium | 4.3 | 2025-06-10 | SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from… |
CVE-2025-42990 | Low | 3.0 | 2025-06-10 | Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the… |
CVE-2025-42989 | Critical | 9.6 | 2025-06-10 | RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploita… |
CVE-2025-42988 | Low | 3.7 | 2025-06-10 | Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal ne… |
CVE-2025-42987 | Medium | 4.3 | 2025-06-10 | SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter… |
CVE-2025-42984 | Medium | 5.4 | 2025-06-10 | SAP S/4HANA Manage Central Purchase Contract does not perform necessary authorization checks for an authenticated user. Due to this, an attacker could execute… |
CVE-2025-42983 | High | 8.5 | 2025-06-10 | SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or… |
CVE-2025-42982 | High | 8.8 | 2025-06-10 | SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials. Thi… |
CVE-2025-42977 | High | 7.6 | 2025-06-10 | SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user… |
CVE-2025-31325 | Medium | 5.8 | 2025-06-10 | Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject malicious JavaScript into a… |
CVE-2025-23192 | High | 8.2 | 2025-06-10 | SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the vi… |
CVE-2025-43011 | High | 7.7 | 2025-05-13 | Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to… |
CVE-2025-43010 | High | 8.3 | 2025-05-13 | SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a cer… |
CVE-2025-43009 | Medium | 6.3 | 2025-05-13 | SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This… |
CVE-2025-43008 | Medium | 5.8 | 2025-05-13 | Due to missing authorization check, an unauthorized user can view the files of other company. This might lead to disclosure of personal data of employees. Ther… |
CVE-2025-43007 | Medium | 6.3 | 2025-05-13 | SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This… |
CVE-2025-43006 | Medium | 6.1 | 2025-05-13 | SAP Supplier Relationship Management (Master Data Management Catalogue) allows an unauthenticated attacker to execute malicious scripts in the application, pot… |