Sap Se Sap Fiori Launchpad vulnerabilities
5 known vulnerabilities affecting sap_se/sap_fiori_launchpad.
Total CVEs
5
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM4
Vulnerabilities
Page 1 of 1
CVE-2020-26815P3HIGHCVSS 8.6fixed in 750fixed in 751+4 more2020-11-10
CVE-2020-26815 [HIGH] CWE-918 CVE-2020-26815: SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthori
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external network to retrieve sensitive / confidential resources
nvd
CVE-2026-76974P4MEDIUMCVSS 5.3vSAP_UI 757v758+2 more2026-09-22
CVE-2026-76974 [MEDIUM] CWE-95 CVE-2026-76974: SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resu
nvd
CVE-2020-26825P4MEDIUMCVSS 6.1fixed in 750fixed in 751+4 more2020-11-13
CVE-2020-26825 [MEDIUM] CWE-79 CVE-2020-26825: SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthori
SAP Fiori Launchpad (News tile Application), versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user (victim), because News tile does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerabili
nvd
CVE-2020-6210P4MEDIUMCVSS 6.1fixed in 753fixed in 7542020-03-10
CVE-2020-6210 [MEDIUM] CWE-79 CVE-2020-6210: SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and he
SAP Fiori Launchpad, versions- 753, 754, does not sufficiently encode user-controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, leading to reflected Cross-Site Scripting (XSS) vulnerability.
nvd
CVE-2023-49584P4MEDIUMCVSS 4.3vSAP_UI 750vSAP_UI 754+6 more2023-12-12
CVE-2023-49584 [MEDIUM] CWE-444 CVE-2023-49584: SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 75
SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application.
nvd