Read the docs

SAP

Records1968All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical221CVSS 9.0–10.0
CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV
TI-2025-27866 SAP NetWeaver Deserialization Vulnerability Priority CRITICAL 98KEV 2025-05-15TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2025-04-29TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability Priority CRITICAL 90KEV 2025-03-19TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2024-09-30TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability Priority CRITICAL 100KEV 2022-08-18TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records
3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

8 records in Hybris · all components

TI-2018-01842 CVE-2018-2463 · GHSA-74vw-fvv7-2rh7

Server-side request forgery in SAP Hybris Commerce

Priority MEDIUM 41

The Omni Commerce Connect API (OCC) of SAP Hybris Commerce, versions 6.*, is vulnerable to server-side request forgery (SSRF) attacks.

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.01638 Published 2018-09-11 No fix listed CWE-918
TI-2018-01878 CVE-2018-2505 · GHSA-p26g-qhrp-vr2c

Cross-site scripting in SAP Commerce

Priority LOW 30

SAP Commerce does not sufficiently validate user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability in storefronts that are based on the product.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01325 Published 2018-12-11 No fix listed CWE-79
TI-2019-00209 CVE-2019-0238 · GHSA-ghrc-jp7j-cpx2

Cross-site scripting in SAP Commerce

Priority LOW 29

SAP Commerce (previously known as SAP Hybris Commerce), before version 6.7, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01016 Published 2019-01-08 Fixed in 6.7 CWE-79
TI-2016-05892 CVE-2016-6856 · GHSA-95xh-v26r-rgjw

Cross-site scripting (XSS) vulnerability in the Inbox Search feature in Hybris Management…

Priority LOW 29

Cross-site scripting (XSS) vulnerability in the Inbox Search feature in Hybris Management Console (HMC) in SAP Hybris before 6.0 allows remote attackers to inject arbitrary web script or HTML via the itemsperpage paramet…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00872 Published 2016-12-31 No fix listed CWE-79
TI-2016-05894 CVE-2016-6858 · GHSA-r2rx-p49m-3cmj

Cross-site scripting (XSS) vulnerability in the Create Employee feature in Hybris…

Priority LOW 25

Cross-site scripting (XSS) vulnerability in the Create Employee feature in Hybris Management Console (HMC) in SAP Hybris before 5.0.4.11, 5.1.0.x before 5.1.0.11, 5.1.1.x before 5.1.1.12, 5.2.0.x and 5.3.0.x before 5.3.0…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00644 Published 2016-12-31 No fix listed CWE-79
TI-2016-05893 CVE-2016-6857 · GHSA-8x76-m2w3-g2pv

Cross-site scripting (XSS) vulnerability in the Create Catalogue feature in Hybris…

Priority LOW 25

Cross-site scripting (XSS) vulnerability in the Create Catalogue feature in Hybris Management Console (HMC) in SAP Hybris before 5.2.0.13, 5.3.x before 5.3.0.11, 5.4.x before 5.4.0.11, 5.5.0.x before 5.5.0.10, 5.5.1.x be…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00644 Published 2016-12-31 No fix listed CWE-79
Open these records in search →