Read the docs

SAP

Records1968All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical221CVSS 9.0–10.0
CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV
TI-2025-27866 SAP NetWeaver Deserialization Vulnerability Priority CRITICAL 98KEV 2025-05-15TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2025-04-29TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability Priority CRITICAL 90KEV 2025-03-19TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2024-09-30TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability Priority CRITICAL 100KEV 2022-08-18TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records
3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

12 records in Customer Relationship Management Webclient Ui · all components

TI-2024-26528 CVE-2024-39598 · GHSA-v2gf-qrv9-w74g

[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)

Priority LOW 33

SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00309 Published 2024-07-09 No fix listed CWE-918
TI-2018-01752 CVE-2018-2364 · GHSA-v7g6-g954-w29w

Cross-site scripting in SAP CRM WebClient UI

Priority LOW 29

SAP CRM WebClient UI 7.01, 7.31, 7.46, 7.47, 7.48, 8.00, 8.01, S4FND 1.02, does not sufficiently validate and/or encode hidden fields, resulting in Cross-Site Scripting (XSS) vulnerability.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00961 Published 2018-02-14 No fix listed CWE-79
TI-2023-14556 CVE-2023-30742 · GHSA-vprh-934g-cjhc

Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

Priority LOW 28

SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not suffici…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00438 Published 2023-05-09 No fix listed CWE-79
TI-2024-24700 CVE-2024-37174 · GHSA-74m8-3rqg-654q

[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)

Priority LOW 27

Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00256 Published 2024-07-09 No fix listed CWE-79
TI-2024-24699 CVE-2024-37173 · GHSA-p5pq-x82g-r5vj

[Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)

Priority LOW 27

Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00266 Published 2024-07-09 No fix listed CWE-79
TI-2024-22985 CVE-2024-34686 · GHSA-4h5h-v89j-3c37

Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

Priority LOW 27

Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00266 Published 2024-06-11 No fix listed CWE-79
TI-2019-00214 CVE-2019-0245 · GHSA-f47f-9w3q-j59r

Cross-site scripting in SAP CRM WebClient UI

Priority LOW 26

SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00758 Published 2019-01-08 Fixed in 1.12, 1.02 +6 CWE-79
TI-2019-00213 CVE-2019-0244 · GHSA-57w8-fx56-9mg4

Cross-site scripting in SAP CRM WebClient UI

Priority LOW 26

SAP CRM WebClient UI (fixed in SAPSCORE 1.12; S4FND 1.02; WEBCUIF 7.31, 7.46, 7.47, 7.48, 8.0, 8.01) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00758 Published 2019-01-08 Fixed in 1.12, 1.02 +6 CWE-79
TI-2023-13619 CVE-2023-29189 · GHSA-w474-j546-fcg4

HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)

Priority LOW 25

SAP CRM (WebClient UI) - versions S4FND 102, 103, 104, 105, 106, 107, WEBCUIF, 700, 701, 731, 730, 746, 747, 748, 800, 801, allows an authenticated attacker to modify HTTP verbs used in requests to the web server.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00442 Published 2023-04-11 No fix listed CWE-23
TI-2023-13618 CVE-2023-29188 · GHSA-77j2-jh3v-5933

Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI

Priority LOW 25

SAP CRM WebClient UI - versions SAPSCORE 129, S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficie…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00366 Published 2023-05-09 No fix listed CWE-79
TI-2023-10146 CVE-2023-24525 · GHSA-5f56-53rv-c32c

Cross-site scripting in SAP CRM

Priority LOW 24

SAP CRM WebClient UI - versions WEBCUIF 748, 800, 801, S4FND 102, 103, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00345 Published 2023-02-14 No fix listed CWE-79
Open these records in search →