Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
670 results · page 2 of 14
Apr 13, 2026Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that isCVE-2026-27674 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim�s browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.
- Product
- SAP NetWeaver Application Server Java (Web Dynpro Java)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApCVE-2026-22679 · Other software · Weaver Network Co., Ltd. · reported by VulnCheckCritical 9.3
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft POST requests with attacker-controlled interfaceName and methodName parameters to reach command-execution helpers and achieve arbitrary command execution on the system. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-03-31 (UTC).
- Product
- E-cology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordh4cker.zipti.qianxin.com
Mar 21, 2026Weaver Show Posts: Stored Cross-Site ScriptingCVE-2026-2121 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Weaver Show Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_class' parameter in all versions up to, and including, 1.8.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This primarily affects multisite installations where Administrators do not have the unfiltered_html capability.
- Product
- Weaver Show Posts
- Affected
- up to 1.8.1
- What to do
- Affects up to 1.8.1. Update Weaver Show Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 10, 2026Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer LCVE-2026-27688 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could resulCVE-2026-27685 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system.
- Product
- SAP NetWeaver Enterprise Portal Administration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through uCVE-2026-27684 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.4
SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through user-controlled input fields. The application concatenates these inputs directly into SQL queries without proper validation or escaping. As a result, an attacker can manipulate the WHERE clause logic and potentially gain unauthorized access to or modify database information. This vulnerability has no impact on integrity and low impact on the confidentiality and availability of the application.
- Product
- SAP NetWeaver (Feedback Notification)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endCVE-2026-24316 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.4
SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is no impact on availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read CVE-2026-24310 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.5
Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module and read the sensitive information from database catalog of the ABAP system. This vulnerability has low impact on the application's confidentiality with no effect on the integrity and availability.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2026Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, CVE-2026-24309 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.4
Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized content change could lead to reduced system performance or interruptions. The vulnerability has low impact on the application's integrity and availability, with no effect on confidentiality.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memoryCVE-2026-24320 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.1
Due to improper memory management in SAP NetWeaver and ABAP Platform (Application Server ABAP), an authenticated attacker could exploit logical errors in memory management by supplying specially crafted input containing unique characters, which are improperly converted. This may result in memory corruption and the potential leakage of memory content. Successful exploitation of this vulnerability would have a low impact on the confidentiality of the application, with no effect on its integrity or availability.
- Product
- SAP NetWeaver and ABAP Platform (Application Server ABAP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modifiCVE-2026-23687 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.8
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, unauthorized access to sensitive user data and potential disruption of normal system usage.
- Product
- SAP NetWeaver AS ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafCVE-2026-23686 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.4
Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of untrusted entries into generated configuration, allowing manipulation of application-controlled settings. Successful exploitation leads to a low impact on integrity, while confidentiality and availability remain unaffected.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crCVE-2026-23685 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.4
Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.
- Product
- SAP NetWeaver (JMS service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the reqCVE-2026-0509 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.6
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availability, and no impact on the confidentiality of the application.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code CVE-2026-0484 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
Due to missing authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA, an authenticated attacker could access a specific transaction code and modify the text data in the system. This vulnerability has a high impact on integrity of the application with no effect on the confidentiality and availability.
- Product
- SAP NetWeaver Application Server ABAP and SAP S/4HANA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the contCVE-2026-21274 · Other software · Adobe · reported by AdobeHigh 7.8
Dreamweaver Desktop versions 21.6 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could leverage this vulnerability to bypass security measures and execute unauthorized code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Adobe Dreamweaver Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write.CVE-2026-21272 · Other software · Adobe · reported by AdobeHigh 8.6
Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could leverage this vulnerability to manipulate or inject malicious data into files on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.
- Product
- Adobe Dreamweaver Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the coCVE-2026-21271 · Other software · Adobe · reported by AdobeHigh 8.6
Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.
- Product
- Adobe Dreamweaver Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the coCVE-2026-21268 · Other software · Adobe · reported by AdobeHigh 8.6
Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.
- Product
- Adobe Dreamweaver Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2026Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnCVE-2026-21267 · Other software · Adobe · reported by AdobeHigh 8.6
Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.
- Product
- Adobe Dreamweaver Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping CVE-2026-0510 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3
The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographic algorithm for encrypting User Mapping data. This weakness could allow an attacker with high-privileged access to exploit the vulnerability under specific conditions potentially leading to partial disclosure of sensitive information.This has low impact on confidentiality with no impact on integrity and availability of the application.
- Product
- NW AS Java UME User Mapping
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access aCVE-2026-0507 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.4
Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating system commands. Successful exploitation could lead to full compromise of the system�s confidentiality, integrity, and availability.
- Product
- SAP Application Server for ABAP and SAP NetWeaver RFCSDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execuCVE-2026-0506 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected.
- Product
- SAP NetWeaver Application Server ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 12, 2026SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter.CVE-2026-0499 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection, resulting in a low impact on the application's confidentiality and integrity, with no impact on availability.
- Product
- SAP NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse autCVE-2025-42875 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.6
The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the application.
- Product
- SAP NetWeaver Internet Communication Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insCVE-2025-42874 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 7.9
SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls. Exploitation does not require user interaction and could lead to service disruption or unauthorized system control. This has high impact on integrity and availability, with no impact on confidentiality.
- Product
- SAP NetWeaver (remote service for Xcelsius)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2025Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute inCVE-2025-42872 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and other sensitive information. As a result, the vulnerability has a low impact on confidentiality and integrity and no impact on availability.
- Product
- SAP NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs.CVE-2025-42919 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access to sensitive application metadata. This results in a partial compromise of the confidentiality of the information without affecting the integrity or availability of the application server.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enablCVE-2025-42884 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.5
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There is no impact on availability.
- Product
- SAP NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges CVE-2025-42883 · Network & remote access · SAP_SE · reported by cna@sap.comLow 2.7
Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low impact on the integrity of the application.
- Product
- SAP NetWeaver Application Server for ABAP (Migration Workbench)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific funcCVE-2025-42882 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system could further assist this attacker to plan subsequent attacks. As a result, this vulnerability has a low impact on confidentiality, with no impact on the integrity or availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions dirCVE-2025-42908 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Application Server for ABAP, an authenticated attacker could initiate transactions directly via the session manager, bypassing the first transaction screen and the associated authorization check. This vulnerability could allow the attacker to perform actions and execute transactions that would normally require specific permissions, compromising the integrity and confidentiality of the system by enabling unauthorized access to restricted functionality. There is no impact to availability from this vulnerability.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2025Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP CVE-2025-42902 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
Due to the memory corruption vulnerability in SAP NetWeaver AS ABAP and ABAP Platform, an unauthenticated attacker can send a corrupted SAP Logon Ticket or SAP Assertion Ticket to the SAP application server. This leads to a dereference of NULL which makes the work process crash. As a result, it has a low impact on the availability but no impact on the confidentiality and integrity.
- Product
- SAP Netweaver AS ABAP and ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025Dreamweaver Desktop versions 21.5 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in arbitrary code execution inCVE-2025-54256 · Other software · Adobe · reported by AdobeHigh 8.6
Dreamweaver Desktop versions 21.5 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must click on a malicious link, and scope is changed.
- Product
- Dreamweaver Desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modifCVE-2025-42958 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.1
Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities. This results in a high impact on the confidentiality, integrity, and availability of the application.
- Product
- SAP NetWeaver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious CVE-2025-42944 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 10
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high impact to the application's confidentiality, integrity, and availability.
- Product
- SAP Netweaver (RMI-P4)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it puCVE-2025-42938 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation, resulting in the creation of malicious content. When executed, this content allows the attacker to access or modify information within the victim's browser scope, impacting the confidentiality and integrity�while availability remains unaffected.
- Product
- SAP NetWeaver ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities iCVE-2025-42927 · Network & remote access · SAP_SE · reported by cna@sap.comLow 3.4
SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of known vulnerabilities in the outdated OpenSSL library would allow user with high system privileges to access and modify system information.This vulnerability has a low impact on confidentiality and integrity, with no impact on availability.
- Product
- SAP NetWeaver AS Java (Adobe Document Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.UpoCVE-2025-42926 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.3
SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additional sensitive information about the system.This vulnerability has a low impact on confidentiality and does not affect the integrity or availability of the server.
- Product
- SAP NetWeaver Application Server Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could preCVE-2025-42925 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time, the attacker could determine a desired identifier which could enable them to access limited system information. This poses a low risk to confidentiality without impacting the integrity or availability of the service.
- Product
- SAP NetWeaver AS Java (IIOP Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file.CVE-2025-42922 · Network & remote access · SAP_SE · reported by cna@sap.comCritical 9.9
SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the system.
- Product
- SAP NetWeaver AS Java (Deploy Web Service)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parametersCVE-2025-42918 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4.3
SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameters. This results in a low impact on confidentiality, with no impact on integrity or availability
- Product
- SAP NetWeaver Application Server for ABAP (Background Processing)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SCVE-2025-42911 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5
SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on the integrity and availability of the application
- Product
- SAP NetWeaver (Service Data Download)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2025A vulnerability was identified in Weaver E-Mobile Mobile Management Platform up to 20250813.CVE-2025-9590 · Other software · Weaver · reported by VulDBLow 2
A vulnerability was identified in Weaver E-Mobile Mobile Management Platform up to 20250813. Affected by this vulnerability is an unknown functionality. The manipulation of the argument gohome leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- E-Mobile Mobile Management Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, couCVE-2025-42976 · Network & remote access · SAP_SE · reported by cna@sap.comHigh 8.1
SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, could cause a memory corruption error. On successful exploitation, this results in the crash of the target component. Multiple submissions can make the target completely unavailable. A similarly crafted submission can be used to perform an out-of-bounds read operation as well, revealing sensitive information that is loaded in memory at that time. There is no ability to modify any information.
- Product
- SAP NetWeaver Application Server ABAP (BIC Document)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document applicationCVE-2025-42975 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document application, embeds a malicious script. When a victim clicks on this link, the script executes in the victim's browser, allowing the attacker to access and/or modify information related to the web client without affecting availability.
- Product
- SAP NetWeaver Application Server ABAP (BIC Document)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicCVE-2025-42948 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation, resulting in the creation of malicious content. When this malicious content gets executed, the attacker could gain the ability to access/modify information within the scope of victim�s browser.
- Product
- SAP NetWeaver ABAP Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025SAP NetWeaver Application Server ABAP has HTML injection vulnerability.CVE-2025-42945 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability could lead to limited access to data or its manipulation. There is no impact on availability.
- Product
- SAP NetWeaver Application Server ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability.CVE-2025-42942 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could access and modify limited information within the scope of victim's browser. This vulnerability has no impact on availability of the application.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2025The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allowCVE-2025-42936 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.4
The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.
- Product
- SAP NetWeaver Application Server for ABAP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.