Sap Se Sap S 4Hana vulnerabilities

CVE-2022-32248 [MEDIUM] CWE-20 CVE-2022-32248: Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102 Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the database. This leads to an impact on the integrity of the data.

CVE-2020-6199 [MEDIUM] CWE-862 CVE-2020-6199: The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN ver The view FIMENAV_COMPCERT in SAP ERP (MENA Certificate Management), EAPPGLO version 607, SAP_FIN versions- 618, 730 and SAP S/4HANA (MENA Certificate Management), S4CORE versions- 100, 101, 102, 103, 104; does not have any authorization check to it due to which an attacker without an authorization group can maintain any company certificate, leading to

CVE-2023-40306 [MEDIUM] CWE-601 CVE-2023-40306: SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity.

CVE-2026-27673 [MEDIUM] CWE-862 CVE-2026-27673: Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authentic Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated user to delete files on the operating system and gain unauthorized control over file operations which could leads to no impact on Confidentiality, Low impact on Integrity and Availability of the application.

CVE-2024-33002 [MEDIUM] CWE-79 CVE-2024-33002: Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-c Document Service handler (obsolete) in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability with low impact on Confidentiality and Integrity of the application.

CVE-2020-6185 [MEDIUM] CWE-79 CVE-2020-6185: Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4 Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability.

CVE-2026-89121 [MEDIUM] CWE-862 CVE-2026-89121: SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrit

CVE-2026-76959 [MEDIUM] CWE-352 CVE-2026-76959: SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request For SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results i

CVE-2026-76962 [MEDIUM] CWE-862 CVE-2026-76962: SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not be accessible to them. This results in a low impact on availability. There is no impact on confidentiality and in

CVE-2026-44771 [MEDIUM] CWE-862 CVE-2026-44771: SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated use SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the entity resulting in escalation of privileges. This results in low impact on confidentiality, with no impact on integrity and availability of the application.

CVE-2020-6214 [MEDIUM] CWE-863 CVE-2020-6214: SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in s SAP S/4HANA (Financial Products Subledger), version 100, uses an incorrect authorization object in some reports. Although the affected reports are protected with other authorization objects, exploitation of the vulnerability would allow an authenticated attacker to view, change, or delete data, thereby preventing the proper segregation of duties in th

CVE-2025-27433 [MEDIUM] CWE-639 CVE-2025-27433: The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functional The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a reversed bank statement. This vulnerability has a low impact on the application's integrity, with no effect on confidentiality and availability of the application.

CVE-2025-27436 [MEDIUM] CWE-639 CVE-2025-27436: The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an aut The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact with a resource is legitimate, allowing the attacker to delete the attachment of a posted bank statement. This leads to a low impact on integrity, with no impact on the confidentiality of the da

CVE-2025-42939 [MEDIUM] CWE-863 CVE-2025-42939: SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with ba SAP S/4HANA (Manage Processing Rules - For Bank Statements) allows an authenticated attacker with basic privileges to delete conditions from any shared rule of any user by tampering the request parameter. Due to missing authorization check, the attacker can delete shared rule conditions that should be restricted, compromising the integrity of the ap

CVE-2025-42987 [MEDIUM] CWE-862 CVE-2025-42987: SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit sh SAP Manage Processing Rules (For Bank Statement) allows an attacker with basic privileges to edit shared rules of any user by tampering the request parameter. Due to missing authorization check, the attacker can edit rules that should be restricted, compromising the integrity of the application.

CVE-2025-42934 [MEDIUM] CWE-113 CVE-2025-42934: SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into the 'Trusted Sites' configuration by injecting line feed (LF) characters into application inputs. This vulnerability has a low impact on the application's integrity and no impact on confidentia

CVE-2025-42991 [MEDIUM] CWE-862 CVE-2025-42991: SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows SAP S/4HANA (Bank Account Application) does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from bank account application of other user, leading to a low impact on integrity, with no impact on the confidentiality of the data or the availability of the application.

CVE-2025-23188 [MEDIUM] CWE-862 CVE-2025-23188: An authenticated user with low privileges can exploit a missing authorization check in an IBS module An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions beyond their intended permissions. This causes a low impact on integrity with no impact on confidentiality and availability.

CVE-2023-41369 [MEDIUM] CWE-611 CVE-2023-41369: The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 1 The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down the browser.

CVE-2026-76960 [LOW] CWE-352 CVE-2026-76960: SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request For SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be triggered on the web server on their behalf. This results in