Sap Se Sap Netweaver Application Server Abap vulnerabilities

CVE-2026-44760 [MEDIUM] CWE-79 CVE-2026-44760: Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages frame Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions. Successful exploitation could allow the attacker to steal

CVE-2024-47593 [MEDIUM] CWE-276 CVE-2024-47593: SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server is in use and the file in question was previously opened or downloaded in an application based on SAP GUI for HTM

CVE-2025-26653 [MEDIUM] CWE-79 CVE-2025-26653: SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading t SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to Stored Cross-Site Scripting (XSS) vulnerability. This enables an attacker, without requiring any privileges, to inject malicious JavaScript into a website. When a user visits the compromised page, the injected script gets executed, potentially compro

CVE-2026-27680 [MEDIUM] CWE-276 CVE-2026-27680: Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allow Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, whi

CVE-2025-0068 [MEDIUM] CWE-862 CVE-2025-0068: An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authori An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application.

CVE-2020-6371 [MEDIUM] CVE-2020-6371: User enumeration vulnerability can be exploited to get a list of user accounts and personal user inf User enumeration vulnerability can be exploited to get a list of user accounts and personal user information can be exposed in SAP NetWeaver Application Server ABAP (POWL test application) versions - 710, 711, 730, 731, 740, 750, leading to Information Disclosure.