Read the docs

SAP

Records1968All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical221CVSS 9.0–10.0
CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV
TI-2025-27866 SAP NetWeaver Deserialization Vulnerability Priority CRITICAL 98KEV 2025-05-15TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2025-04-29TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability Priority CRITICAL 90KEV 2025-03-19TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2024-09-30TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability Priority CRITICAL 100KEV 2022-08-18TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records
3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

12 records in Abap Platform · all components

TI-2021-19921 CVE-2021-44231 · GHSA-9fmx-fx6p-rcq8

Code injection in SAP ABAP Server & ABAP Platform

Priority MEDIUM 45

Internally used text extraction reports allow an attacker to inject code that can be executed by the application.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01391 Published 2021-12-14 Fixed in 701, 740 +8 CWE-94
TI-2024-14732 CVE-2024-22131 · GHSA-crh3-fj9c-p494

Code Injection vulnerability in SAP ABA (Application Basis)

Priority MEDIUM 43

In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a vulnerable interface.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01079 Published 2024-02-13 No fix listed CWE-94
TI-2020-05148 CVE-2020-6296 · GHSA-x7q6-8p3j-gwjm

SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730…

Priority MEDIUM 41

SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 753, 755, allows an attacker to inject code that can be executed by the application, leading to Code Injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01327 Published 2020-08-12 Fixed in 700, 701 +10
TI-2020-05170 CVE-2020-6318 · GHSA-rppr-4h7c-mc9c

Code injection in SAP NetWeaver and ABAP Platform

Priority MEDIUM 40

A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server, up to release 7.40) and ABAP Platform (> release 7.40).Because of this, an attacker can exploit these products via Code Injection, and poten…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.05826 Published 2020-09-09 Fixed in 700, 701 +12 CWE-94
TI-2023-10915 CVE-2023-25615 · GHSA-x94j-mc2f-6995

SQL Injection vulnerability in SAP ABAP Platform

Priority LOW 31

Due to insufficient input sanitization, SAP ABAP - versions 751, 753, 753, 754, 756, 757, 791, allows an authenticated high privileged user to alter the current session of the user by injecting the malicious database que…

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00546 Published 2023-03-14 No fix listed CWE-89
TI-2024-18506 CVE-2024-27900 · GHSA-r7v7-m4x6-4rxm

Missing Authorization check in SAP ABAP Platform

Priority LOW 24

Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templates from shared to private.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00393 Published 2024-03-12 No fix listed CWE-862
TI-2020-05162 CVE-2020-6310 · GHSA-cvcj-pj4r-5rm5

Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP…

Priority LOW 22

Improper access control in SOA Configuration Trace component in SAP NetWeaver (ABAP Server) and ABAP Platform, versions - 702, 730, 731, 740, 750, allows any authenticated user to enumerate all SAP users, leading to Info…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00938 Published 2020-08-12 Fixed in 702, 730 +3
Open these records in search →