Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.0Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlledCheck if you run itEPSS 0.22%Jun 10, 2025
- Critical9.6RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.Check if you run itEPSS 0.44%Jun 10, 2025
- Low3.7Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crCheck if you run itEPSS 0.25%Jun 10, 2025
- Medium4.3SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter.Check if you run itEPSS 0.22%Jun 10, 2025
- Medium5.4SAP S/4HANA Manage Central Purchase Contract does not perform necessary authorization checks for an authenticated user.Check if you run itEPSS 0.26%Jun 10, 2025
- High8.5SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or rendering the systemCheck if you run itEPSS 0.31%Jun 10, 2025
- High8.8SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials.Check if you run itEPSS 0.39%Jun 10, 2025
- High7.6SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user.Check if you run itEPSS 0.59%Jun 10, 2025
- Medium5.8Due to a Cross-Site Scripting vulnerability in SAP NetWeaver (ABAP Keyword Documentation), an unauthenticated attacker could inject malicious JavaScript into a web page through anCheck if you run itEPSS 0.31%Jun 10, 2025
- High8.2SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace.Check if you run itEPSS 0.37%Jun 10, 2025
- UnknownLaravel Laravel Framework Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')Patch nowKEVEPSS 44.76%Jun 8, 2025
- UnknownSAP NetWeaver Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 41.45%Jun 8, 2025
- UnknownSAP internet_graphics_server Improper Restriction of XML External Entity ReferencePatch nowKEVEPSS 41.05%Jun 7, 2025
- Critical9.3A vulnerability was found in D-Link DIR-816 1.10CNB05 and classified as critical.Check if you run itEPSS 2.49%Jun 5, 2025
- High7.3A flaw was found in GIMP when processing XCF image files.Check if you run itEPSS 0.24%May 27, 2025
- Critical9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, CCheck if you run itEPSS 0.43%May 23, 2025
- High7.7Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to access restricted funCheck if you run itEPSS 0.36%May 13, 2025
- High8.3SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certain function moduleCheck if you run itEPSS 0.47%May 13, 2025
- Medium6.3SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges.Check if you run itEPSS 0.26%May 13, 2025
- Medium5.8Due to missing authorization check, an unauthorized user can view the files of other company.Check if you run itEPSS 0.36%May 13, 2025
- Medium6.3SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges.Check if you run itEPSS 0.26%May 13, 2025
- Medium6.1SAP Supplier Relationship Management (Master Data Management Catalogue) allows an unauthenticated attacker to execute malicious scripts in the application, potentially leading to aCheck if you run itEPSS 0.29%May 13, 2025
- Medium4.3SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store user credentials.Check if you run itEPSS 0.18%May 13, 2025
- Medium5.3Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to access customer data when they access theCheck if you run itEPSS 0.36%May 13, 2025
- Medium6.4SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field.Check if you run itEPSS 0.33%May 13, 2025