SAP vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
181 matching records
- UnknownSAP NetWeaver Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 41.45%Jun 8, 2025
- UnknownSAP internet_graphics_server Improper Restriction of XML External Entity ReferencePatch nowKEVEPSS 41.05%Jun 7, 2025
- High7.3A flaw was found in GIMP when processing XCF image files.Check if you run itEPSS 0.25%May 27, 2025
- High7.7Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to access restricted funCheck if you run itEPSS 0.36%May 13, 2025
- High8.3SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certain function moduleCheck if you run itEPSS 0.47%May 13, 2025
- Medium6.3SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges.Check if you run itEPSS 0.26%May 13, 2025
- Medium5.8Due to missing authorization check, an unauthorized user can view the files of other company.Check if you run itEPSS 0.36%May 13, 2025
- Medium6.3SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges.Check if you run itEPSS 0.26%May 13, 2025
- Medium6.1SAP Supplier Relationship Management (Master Data Management Catalogue) allows an unauthenticated attacker to execute malicious scripts in the application, potentially leading to aCheck if you run itEPSS 0.29%May 13, 2025
- Medium4.3SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store user credentials.Check if you run itEPSS 0.18%May 13, 2025
- Medium5.3Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to access customer data when they access theCheck if you run itEPSS 0.36%May 13, 2025
- Medium6.4SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying this field.Check if you run itEPSS 0.33%May 13, 2025
- Medium4.3SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check.Check if you run itEPSS 0.31%May 13, 2025
- High7.9Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.This has High impact on Confidentiality withCheck if you run itEPSS 0.16%May 13, 2025
- Medium6.6Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application.Check if you run itEPSS 0.28%May 13, 2025
- Medium6.2SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings.Check if you run itEPSS 0.36%May 13, 2025
- High8.6The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which wheCheck if you run itEPSS 0.42%May 13, 2025
- Critical10.0The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload rCheck if you run itEPSS 0.83%May 13, 2025
- Medium5.3The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attaCheck if you run itEPSS 0.37%May 13, 2025
- Medium6.1The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attaCheck if you run itEPSS 0.29%May 13, 2025
- Medium6.1he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacCheck if you run itEPSS 0.30%May 13, 2025
- Medium4.4The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script.Check if you run itEPSS 0.21%May 13, 2025
- Critical9.1SAP NetWeaver Deserialization VulnerabilityPatch nowKEVEPSS 12.85%Apr 27, 2025
- Medium6.5A flaw was found in libsoup.Check if you run itEPSS 0.59%Apr 24, 2025
- Medium4.6SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server.Check if you run itEPSS 0.14%Apr 22, 2025