Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,431 results · page 10 of 49
Mar 10, 2025The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact witCVE-2025-27436 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact with a resource is legitimate, allowing the attacker to delete the attachment of a posted bank statement. This leads to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application.
- Product
- SAP S/4HANA (Manage Bank Statements)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can bCVE-2025-27434 · Websites & servers · SAP_SE · reported by cna@sap.comHigh 8.8
Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high impact on the confidentiality, integrity, and availability of data in SAP Commerce.
- Product
- SAP Commerce (Swagger UI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reCVE-2025-27433 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application's integrity, with no effect on confidentiality and availability of the application.
- Product
- SAP S/4HANA (Manage Bank Statements)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized accessCVE-2025-27432 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2.4
The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized access to each transaction. By executing the specific ABAP method within the ABAP system, an unauthorized attacker could call each transaction and view the inbound delivery details. This vulnerability has a low impact on the confidentiality with no effect on the integrity and the availability of the application.
- Product
- SAP Electronic Invoicing for Brazil (eDocument Cockpit)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS).CVE-2025-27431 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS). This could enable an attacker to inject malicious payload that gets stored and executed when a user accesses the functionality, hence leading to information disclosure or unauthorized data modifications within the scope of victim�s browser. There is no impact on availability.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted infoCVE-2025-27430 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted information. This flaw enables the attacker to send requests to internal network resources, thereby compromising the application's confidentiality. There is no impact on integrity or availability
- Product
- SAP CRM and SAP S/4HANA (Interaction Center)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalCVE-2025-26661 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high impact on the integrity and availability of the application.
- Product
- SAP NetWeaver (ABAP Class Builder)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately CVE-2025-26660 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately defined. This vulnerability allows an attacker with low privileges to bypass access controls within the application, enabling them to potentially modify data. Confidentiality and Availability are not impacted.
- Product
- SAP Fiori apps (Posting Library)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability.CVE-2025-26659 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability
- Product
- SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthCVE-2025-26658 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.8
The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unauthorized actions. Due to the improper session management, the attackers can elevate themselves to higher privilege and can read, modify and/or write new data. To gain authenticated sessions of other users, the attacker must invest considerable time and effort. This vulnerability has a high impact on the confidentiality and integrity of the application with no effect on the availability of the application.
- Product
- SAP Business One (Service Layer)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privCVE-2025-26656 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on integrity of the application.
- Product
- S/4HANA (Manage Purchasing Info Records)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise bCVE-2025-26655 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1
SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise be restricted, potentially causing a low impact on the integrity of the application.Confidentiality and Availability are not impacted.
- Product
- SAP Just In Time
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured.CVE-2025-25245 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a limited impact on confidentiality and integrity within the scope of victim�s browser. There is no impact on availability.
- Product
- SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check.CVE-2025-25244 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.7
SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display authorization for the process chain object could set one or all processes to be skipped. This means corresponding activities, such as data loading, activation, or deletion, will not be executed as initially modeled. This could lead to unexpected results in business reporting leading to a significant impact on integrity. However, there is no impact on confidentiality or availability.
- Product
- SAP Business Warehouse (Process Chains)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerabilCVE-2025-25242 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting.CVE-2025-23194 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user can set it to an undesired value causing low impact on integrity. There is no impact on confidentiality or availability of the application.
- Product
- SAP NetWeaver Enterprise Portal (OBN component)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions CVE-2025-23188 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions beyond their intended permissions. This causes a low impact on integrity with no impact on confidentiality and availability.
- Product
- SAP S/4HANA (RBD)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown toCVE-2025-23185 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.1
Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with administrator level privileges has access to this disclosed information, and they could use it to craft further exploits. There is no impact on the integrity and availability of the application.
- Product
- SAP Business Objects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter CVE-2025-0071 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.9
SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter value. This exposes unencrypted passwords in the logs, causing a high impact on the confidentiality of the application. There is no impact on integrity or availability.
- Product
- SAP Web Dispatcher and Internet Communication Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports.CVE-2025-0062 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.7
SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the victim's browser each time the vulnerable page is visited by the victim. On successful exploitation, an attacker could cause limited impact on confidentiality and integrity within the scope of victim�s browser. There is no impact on availability. This vulnerability occurs only when script/html execution is enabled by the administrator in Central Management Console.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2025Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AtaksAPP Reservation Management System allows CrossCVE-2025-0877 · Other software · AtaksAPP · reported by iletisim@usom.gov.trMedium 4.7
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AtaksAPP Reservation Management System allows Cross-Site Scripting (XSS). This issue affects Reservation Management System: before 4.2.3.
- Product
- Reservation Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsiberguvenlik.gov.trusom.gov.tr
Mar 1, 2025A vulnerability has been found in Pixsoft E-Saphira 1.7.24 and classified as critical.CVE-2025-1808 · Other software · Pixsoft · reported by VulDBMedium 6.9
A vulnerability has been found in Pixsoft E-Saphira 1.7.24 and classified as critical. This vulnerability affects unknown code of the file /servlet?act=login&tipo=1 of the component Login Endpoint. The manipulation of the argument txtUsuario leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Saphira
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2025The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerablCVE-2025-1450 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-hover’ parameter in all versions up to, and including, 3.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected
- up to 3.3.5
- What to do
- Affects up to 3.3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 10, 2025SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbiCVE-2025-25243 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.6
SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive information with no impact to integrity or availability.
- Product
- SAP Supplier Relationship Management (Master Data Management Catalog)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to acceCVE-2025-25241 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
Due to a missing authorization check, an attacker who is logged in to application can view/ delete �My Overtime Requests� which could allow the attacker to access employee information. This leads to low impact on confidentiality, integrity of the application. There is no impact on availability.
- Product
- SAP Fiori Apps Reference Library (My Overtime Requests)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass.CVE-2025-24876 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application
- Product
- SAP Approuter Node.js package
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None).CVE-2025-24875 · Websites & servers · SAP_SE · reported by cna@sap.comMedium 6.8
SAP Commerce, by default, sets certain cookies with the SameSite attribute configured to None (SameSite=None). This includes authentication cookies utilized in SAP Commerce Backoffice. Applying this setting reduces defense in depth against CSRF and may lead to future compatibility issues.
- Product
- SAP Commerce
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking.CVE-2025-24874 · Websites & servers · SAP_SE · reported by cna@sap.comMedium 6.8
SAP Commerce (Backoffice) uses the deprecated X-FRAME-OPTIONS header to protect against clickjacking. While this protection remains effective now, it may not be the case in the future as browsers might discontinue support for this header in favor of the frame-ancestors CSP directive. Hence, clickjacking could become possible then, and lead to exposure and modification of sensitive information.
- Product
- SAP Commerce (Backoffice)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction.CVE-2025-24872 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
The ABAP Build Framework in SAP ABAP Platform allows an authenticated attacker to gain unauthorized access to a specific transaction. By executing the add-on build functionality within the ABAP Build Framework, an attacker could call the transaction and view its details. This has a limited impact on the confidentiality of the application with no effect on the integrity and availability of the application.
- Product
- SAP ABAP Platform (ABAP Build Framework)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information witCVE-2025-24870 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6
SAP GUI for Windows & RFC service credentials are incorrectly stored in the memory of the program allowing an unauthenticated attacker to access information within systems, resulting in privilege escalation. On successful exploitation, this could result in disclosure of highly sensitive information. This has no impact on integrity, and availability.
- Product
- SAP GUI for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XCVE-2025-24869 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even though they may not need it. These XML files are not entirely SAP-internal as they are deployed with the server. In such a scenario, sensitive information could be exposed without compromising its integrity or availability.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticaCVE-2025-24868 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.1
The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a malicious site due to insufficient redirect URL validation. On successful exploitation attacker can cause limited impact on confidentiality, integrity, and availability of the system.
- Product
- SAP HANA extended application services, advanced model (User Account and Authentication Services)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability.CVE-2025-24867 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP BusinessObjects Platform (BI Launchpad) does not sufficiently handle user input, resulting in Cross-Site Scripting (XSS) vulnerability. The application allows an unauthenticated attacker to craft a URL that embeds a malicious script within an unprotected parameter. When a victim clicks the link, the script will be executed in the browser, giving the attacker the ability to access and/or modify information related to the web client with no effect on availability.
- Product
- SAP BusinessObjects Platform (BI Launchpad)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of CVE-2025-23193 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modification and has no impact on server availability.
- Product
- SAP NetWeaver Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request.CVE-2025-23191 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1
Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the `atom:link` values in the returned metadata redirecting them from the SAP server to a malicious link set by the attacker. Successful exploitation could cause low impact on integrity of the application.
- Product
- SAP Fiori for SAP ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherCVE-2025-23190 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization check, an authenticated attacker could call a remote-enabled function module which allows them to access data that they would otherwise not have access to. The attacker cannot modify data or impact the availability of the system.
- Product
- SAP NetWeaver and ABAP platform (ST-PI)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data.CVE-2025-23189 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an authenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability
- Product
- SAP NetWeaver and ABAP Platform (SDCCN)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data.CVE-2025-23187 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to missing authorization check in an RFC enabled function module in transaction SDCCN, an unauthenticated attacker could generate technical meta-data. This leads to a low impact on integrity. There is no impact on confidentiality or availability.
- Product
- SAP NetWeaver and ABAP Platform (SDCCN)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to geneCVE-2025-0064 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.7
Under specific conditions, the Central Management Console of the SAP BusinessObjects Business Intelligence platform allows an attacker with admin rights to generate or retrieve a secret passphrase, enabling them to impersonate any user in the system. This results in a high impact on confidentiality and integrity, with no impact on availability.
- Product
- SAP BusinessObjects Business Intelligence platform (Central Management Console)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability.CVE-2025-0054 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be later executed in the victim's web browser. With this the attacker might be able to read or modify information associated with the vulnerable web page.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025On Page SEO + Whatsapp Chat Button: Cross-Site Request Forgery (CSRF)CVE-2025-25138 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through <= 2.0.0.
- Product
- On Page SEO + Whatsapp Chat Button
- Affected
- up to 2.0.0
- What to do
- Affects up to 2.0.0. Update On Page SEO + Whatsapp Chat Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 23, 2025Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.CVE-2024-57386 · Other software · Wallosapp · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Wallos v.2.41.0 allows a remote attacker to execute arbitrary code via the profile picture function.
- Product
- Wallos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper CVE-2025-0070 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can result in potential security concerns. This results in a high impact on confidentiality, integrity, and availability.
- Product
- SAP NetWeaver Application Server for ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user�s Windows account cCVE-2025-0069 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.8
Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user�s Windows account could gain higher privileges. With this, he could move laterally within the network and further compromise the active directory of a company. This leads to high impact on confidentiality, integrity and availability of the Windows server.
- Product
- SAPSetup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks.CVE-2025-0068 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo conneCVE-2025-0067 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.3
Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This could lead to low impact on confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due CVE-2025-0066 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and availability of an application
- Product
- SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules.CVE-2025-0063 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromise of confidentiality, integrity and availability.
- Product
- SAP NetWeaver AS ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interactionCVE-2025-0061 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.7
SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive infoCVE-2025-0060 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP BusinessObjects Business Intelligence Platform allows an authenticated user with restricted access to inject malicious JS code which can read sensitive information from the server and send it to the attacker. The attacker could further use this information to impersonate as a high privileged user causing high impact on confidentiality and integrity of the application.
- Product
- SAP BusinessObjects Business Intelligence Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.