Read the docs

SAP

Records1968All Threatist records
Exploited (KEV)14In CISA KEV
CVSS critical221CVSS 9.0–10.0
CVSS high534CVSS 7.0–8.9

Exploited now

SAP records in CISA KEV
TI-2025-27866 SAP NetWeaver Deserialization Vulnerability Priority CRITICAL 98KEV 2025-05-15TI-2025-22522 SAP NetWeaver Unrestricted File Upload Vulnerability Priority CRITICAL 100KEV 2025-04-29TI-2017-09362 SAP NetWeaver Directory Traversal Vulnerability Priority CRITICAL 90KEV 2025-03-19TI-2019-00284 SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability Priority CRITICAL 100KEV 2024-09-30TI-2022-06811 SAP Multiple Products HTTP Request Smuggling Vulnerability Priority CRITICAL 100KEV 2022-08-18TI-2016-02146 SAP NetWeaver SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-06-09

Components

Products in the NVD configurations · select one to filter the records
3d Visual Enterprise Viewer 131 records MEDIUM Netweaver 102 records CRITICAL Netweaver Application Server Abap 86 records CRITICAL Businessobjects Business Intelligence Platform 73 records MEDIUM Netweaver Application Server Java 69 records CRITICAL Businessobjects Business Intelligence 45 records HIGH Hana 38 records MEDIUM Solution Manager 33 records CRITICAL

Records

11 records in Supplier Relationship Management · all components

TI-2023-20572 CVE-2023-39436 · GHSA-455r-7p7w-hg5r

Information Disclosure in SAP Supplier Relationship Management

Priority LOW 32

SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication f…

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00438 Published 2023-08-08 No fix listed CWE-306
TI-2014-03398 CVE-2014-4159 · GHSA-5mxc-qxfq-q7g7

Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship…

Priority LOW 29

Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url paramete…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01282 Published 2014-06-13 No fix listed
TI-2019-00296 CVE-2019-0361 · GHSA-x9hh-7xwv-27jh

Cross-site scripting in SAP Supplier Relationship Management

Priority LOW 28

SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabi…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00648 Published 2019-09-10 Fixed in 3.73, 7.31 +1 CWE-79
TI-2026-00321 CVE-2026-0513 · GHSA-w8gf-92gc-cx36

Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)

Priority LOW 21

Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirects them to an att…

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00204 Published 2026-01-13 No fix listed CWE-601
Open these records in search →