Read the docs

SAP

Records1968All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical221CVSS 9.0–10.0
CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV
TI-2025-27866 SAP NetWeaver Deserialization Vulnerability Priority CRITICAL 98KEV 2025-05-15TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2025-04-29TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability Priority CRITICAL 90KEV 2025-03-19TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2024-09-30TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability Priority CRITICAL 100KEV 2022-08-18TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records
3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

10 records in Netweaver As Abap Business Server Pages · all components

TI-2023-13615 CVE-2023-29185 · GHSA-c9w5-v8r2-gv7f

Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)

Priority LOW 30

SAP NetWeaver AS for ABAP (Business Server Pages) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00572 Published 2023-04-11 No fix listed CWE-400
TI-2020-05071 CVE-2020-6215 · GHSA-pgg5-qq33-fx32

Open redirect in SAP NetWeaver AS ABAP

Priority LOW 30

SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, allows an attacker to redirect users to a malicious site due to insufficient URL validati…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01523 Published 2020-04-14 Fixed in 700, 701 +9 CWE-601
TI-2020-05176 CVE-2020-6324 · GHSA-c4pp-v922-7762

Cross-site scripting in SAP NetWeaver AS ABAP

Priority LOW 29

SAP Netweaver AS ABAP(BSP Test Application sbspext_table), version-700,701,720,730,731,740,750,751,752,753,754,755, allows an unauthenticated attacker to send polluted URL to the victim, when the victim clicks on this UR…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00895 Published 2020-09-09 Fixed in 700, 701 +10 CWE-79
TI-2020-05069 CVE-2020-6213 · GHSA-3cxp-7r2h-jh9g

Cross-site scripting in SAP NetWeaver AS ABAP

Priority LOW 29

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_PHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting (XSS) via different URL paramet…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2020-04-24 Fixed in 700, 701 +9 CWE-79
TI-2020-05061 CVE-2020-6205 · GHSA-xj38-pj67-738p

Cross-site scripting in SAP NetWeaver Application Server ABAP - SAP_BASIS

Priority LOW 29

SAP NetWeaver AS ABAP Business Server Pages (Smart Forms), SAP_BASIS versions- 7.00, 7.01, 7.02, 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, 7.51, 7.52, 7.53, 7.54; does not sufficiently encode user controlled inputs, allowing a…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00768 Published 2020-03-10 Fixed in 7.00, 7.01 +11 CWE-79
TI-2020-05102 CVE-2020-6246 · GHSA-2jgc-5rvf-93wc

Cross-site scripting in SAP NetWeaver AS ABAP

Priority LOW 28

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cros…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00654 Published 2020-06-10 Fixed in 700, 701 +9 CWE-79
TI-2020-05085 CVE-2020-6229 · GHSA-p9pq-9vfw-wcq6

Cross-site scripting in SAP NetWeaver AS ABAP

Priority LOW 28

SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not sufficiently encode user controlled inputs, resul…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00654 Published 2020-04-14 Fixed in 700, 701 +14 CWE-79
TI-2020-05073 CVE-2020-6217 · GHSA-xrfg-5m62-c7c7

Cross-site scripting in SAP NetWeaver AS ABAP

Priority LOW 28

SAP NetWeaver AS ABAP Business Server Pages Test Application IT00, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Sc…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00654 Published 2020-04-14 Fixed in 700, 701 +9 CWE-79
TI-2023-10150 CVE-2023-24529 · GHSA-jcxw-8wmf-frrv

Cross-site scripting in SAP NetWeaver AS ABAP

Priority LOW 27

Due to lack of proper input validation, BSP application (CRM_BSP_FRAME) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75D, 75E, 75F, 75G, 75H, allow malicious inputs from untrusted sources, which can be leverag…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00357 Published 2023-02-14 No fix listed CWE-79
TI-2023-10142 CVE-2023-24521 · GHSA-j995-j9xm-88p3

Cross-site scripting in SAP NetWeaver AS ABAP

Priority LOW 27

Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00388 Published 2023-02-14 No fix listed CWE-79
Open these records in search →