Sap Netweaver Enterprise Portal (Sap Se) - vulnerabilities (CVEs)
20 CVEs, 3 in the last 30 days, 9 known versions, newest CVE from 2026-10-13. Vendor: Sap Se.
CVEs of Sap Netweaver Enterprise Portal
- CVE-2026-89122 - CVSS 6.1 (medium), 2026-10-13: SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link…
- CVE-2026-89118 - CVSS 5.3 (medium), 2026-10-13: SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which…
- CVE-2026-89117 - CVSS 6.1 (medium), 2026-10-13: SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server…
- CVE-2026-44759 - CVSS 6.1 (medium), 2026-07-14: SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server…
- CVE-2026-0499 - CVSS 6.1 (medium), 2026-01-13: SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server…
- CVE-2025-42872 - CVSS 6.1 (medium), 2025-12-09: Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute…
- CVE-2025-42884 - CVSS 6.5 (medium), 2025-11-11: SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations,…
- CVE-2024-44120 - CVSS 4.7 (medium), 2024-09-10: SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated…
- CVE-2024-25645 - CVSS 5.3 (medium), 2024-03-12: Under certain condition SAP NetWeaver (Enterprise Portal) - version 7.50 allows an attacker to access information which would otherwise be restricted causing…
- CVE-2023-33985 - CVSS 6.1 (medium), 2023-06-13: SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site…
- CVE-2022-35225 - CVSS 6.1 (medium), 2022-07-12: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs over the network,…
- CVE-2022-35170 - CVSS 6.1 (medium), 2022-07-12: SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-controlled inputs over the network,…
- CVE-2022-32247 - CVSS 6.1 (medium), 2022-07-12: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker…
- CVE-2022-35172 - CVSS 6.1 (medium), 2022-07-12: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in…
- CVE-2022-26105 - CVSS 6.1 (medium), 2022-04-12: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker…
- CVE-2022-24397 - CVSS 6.1 (medium), 2022-03-10: SAP NetWeaver Enterprise Portal - versions 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site…
- CVE-2022-24395 - CVSS 6.1 (medium), 2022-03-10: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in…
- CVE-2021-33705 - CVSS 8.1 (high), 2021-09-15: The SAP NetWeaver Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, component Iviews Editor contains a Server-Side Request Forgery (SSRF)…
- CVE-2021-21489 - CVSS 4.8 (medium), 2021-09-14: SAP NetWeaver Enterprise Portal versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user related data, resulting in Stored…
- CVE-2021-33702 - CVSS 8.3 (high), 2021-08-10: Under certain conditions, NetWeaver Enterprise Portal, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode report data. An…
