Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

SAP_SE — Vulnerabilities & Security Advisories 644

Browse all 644 CVE security advisories affecting SAP_SE. AI-powered Chinese analysis, POCs, and references for each vulnerability.

SAP SE operates as a global leader in enterprise application software, primarily providing ERP solutions that manage complex business processes, supply chains, and human resources for large organizations. This extensive attack surface has resulted in 527 recorded CVEs, reflecting the critical nature of its infrastructure. Historically, vulnerabilities within SAP systems frequently involve remote code execution, SQL injection, and cross-site scripting, often stemming from complex integrations and legacy components. Privilege escalation remains a significant concern, allowing unauthorized users to gain administrative access. While SAP maintains rigorous security protocols, past incidents highlight risks associated with default configurations and unpatched middleware. The company actively issues security patches, yet the sheer volume of disclosed flaws underscores the challenges of securing highly interconnected, mission-critical enterprise environments against sophisticated cyber threats.

CVE ID Title CVSS Severity Published
CVE-2026-0506 Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform — SAP NetWeaver Application Server ABAP and ABAP Platform CWE-862 8.1 High 2026-01-13
CVE-2026-0504 Insufficient Input Handling in JNDI Operations of SAP Identity Management — SAP Identity Management CWE-943 3.8 Low 2026-01-13
CVE-2026-0503 Missing Authorization check in in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) — SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) CWE-862 6.4 Medium 2026-01-13
CVE-2026-0501 SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger) — SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger) CWE-89 9.9 Critical 2026-01-13
CVE-2026-0500 Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation) — SAP Wily Introscope Enterprise Manager (WorkStation) CWE-94 9.6 Critical 2026-01-13
CVE-2026-0499 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal — SAP NetWeaver Enterprise Portal CWE-79 6.1 Medium 2026-01-13
CVE-2026-0498 Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise) — SAP S/4HANA (Private Cloud and On-Premise) CWE-94 9.1 Critical 2026-01-13
CVE-2026-0497 Missing Authorization check in Business Server Pages Application (Product Designer Web UI) — Business Server Pages Application (Product Designer Web UI) CWE-862 4.3 Medium 2026-01-13
CVE-2026-0496 Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) — SAP Fiori App (Intercompany Balance Reconciliation) CWE-434 6.6 Medium 2026-01-13
CVE-2026-0495 Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) — SAP Fiori App (Intercompany Balance Reconciliation) CWE-15 5.1 Medium 2026-01-13
CVE-2026-0494 Information Disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) — SAP Fiori App (Intercompany Balance Reconciliation) CWE-497 4.3 Medium 2026-01-13
CVE-2026-0493 Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) — SAP Fiori App (Intercompany Balance Reconciliation) CWE-352 4.3 Medium 2026-01-13
CVE-2026-0492 Privilege escalation vulnerability in SAP HANA database — SAP HANA database CWE-306 8.8 High 2026-01-13
CVE-2026-0491 Code Injection vulnerability in SAP Landscape Transformation — SAP Landscape Transformation CWE-94 9.1 Critical 2026-01-13
CVE-2025-42928 Deserialization Vulnerability in SAP jConnect - SDK for ASE — SAP jConnect - SDK for ASE CWE-502 9.1 Critical 2025-12-09
CVE-2025-42904 Information Disclosure vulnerability in Application Server ABAP — Application Server ABAP CWE-549 6.5 Medium 2025-12-09
CVE-2025-42896 Server-Side Request Forgery (SSRF) in SAP BusinessObjects Business Intelligence Platform — SAP BusinessObjects Business Intelligence Platform CWE-116 5.4 Medium 2025-12-09
CVE-2025-42891 Missing Authorization check in SAP Enterprise Search for ABAP — SAP Enterprise Search for ABAP CWE-862 5.5 Medium 2025-12-09
CVE-2025-42880 Code Injection vulnerability in SAP Solution Manager — SAP Solution Manager CWE-94 9.9 Critical 2025-12-09
CVE-2025-42878 Sensitive Data Exposure in SAP Web Dispatcher and Internet Communication Manager (ICM) — SAP Web Dispatcher and Internet Communication Manager (ICM) CWE-1244 8.2 High 2025-12-09
CVE-2025-42877 Memory Corruption vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server — SAP Web Dispatcher, Internet Communication Manager and SAP Content Server CWE-787 7.5 High 2025-12-09
CVE-2025-42876 Missing Authorization Check in SAP S/4 HANA Private Cloud (Financials General Ledger) — SAP S/4 HANA Private Cloud (Financials General Ledger) CWE-405 7.1 High 2025-12-09
CVE-2025-42875 Missing Authentication check in SAP NetWeaver Internet Communication Framework — SAP NetWeaver Internet Communication Framework CWE-306 6.6 Medium 2025-12-09
CVE-2025-42874 Denial of service (DOS) in SAP NetWeaver (remote service for Xcelsius) — SAP NetWeaver (remote service for Xcelsius) CWE-405 7.9 High 2025-12-09
CVE-2025-42873 Denial of Service (DoS) in SAPUI5 framework (Markdown-it component) — SAPUI5 framework (Markdown-it component) CWE-405 5.9 Medium 2025-12-09
CVE-2025-42872 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal — SAP NetWeaver Enterprise Portal CWE-489 6.1 Medium 2025-12-09
CVE-2025-42940 Memory Corruption vulnerability in SAP CommonCryptoLib — SAP CommonCryptoLib CWE-787 7.5 High 2025-11-11
CVE-2025-42924 Open Redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP) — SAP S/4HANA landscape (SAP E-Recruiting BSP) CWE-601 6.1 Medium 2025-11-11
CVE-2025-42919 Information Disclosure vulnerability in SAP NetWeaver Application Server Java — SAP NetWeaver Application Server Java CWE-22 5.3 Medium 2025-11-11
CVE-2025-42899 Missing Authorization check in SAP S4CORE (Manage Journal Entries) — SAP S4CORE (Manage Journal Entries) CWE-862 4.3 Medium 2025-11-11

This page lists every published CVE security advisory associated with SAP_SE. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.