Sap Commerce Cloud
Approved changes feed: RSS · Atom
cpe:2.3:a:sap_se:sap_commerce_cloud:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Sap Se (f8f3f5db-c060-5230-a8bd-f91674203607) |
|---|---|
| Product | Sap Commerce Cloud (690db787-989d-5938-bbdd-94339ed3237e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44761 |
vulnerable | 2026-07-29 00:52:14.643343 |
Insecure Sample Credentials in SAP Commerce Cloud
CRITICAL (9.1)
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.
Published: 2026-07-14T00:20:29.454Z
Updated: 2026-07-15T03:58:51.555Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24321 |
vulnerable | 2026-06-08 07:51:17.499589 |
Information Disclosure vulnerability in SAP Commerce Cloud
MEDIUM (5.3)
SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive information that is not intended to be publicly accessible via the front-end. This vulnerability has a low impact on confidentiality and does not affect integrity and availability.
Published: 2026-02-10T03:03:52.708Z
Updated: 2026-02-10T17:01:39.830Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23684 |
vulnerable | 2026-06-08 07:51:15.977622 |
Race condition vulnerability in SAP Commerce Cloud
MEDIUM (5.9)
A race condition vulnerability exists in the SAP Commerce cloud. Because of this when an attacker adds products to a cart, it may result in a cart entry being created with erroneous product value which could be checked out. This leads to high impact on data integrity, with no impact on data confidentiality or availability of the application.
Published: 2026-02-10T03:02:14.829Z
Updated: 2026-02-10T17:19:50.779Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-42906 |
vulnerable | 2026-06-08 07:25:08.393958 |
Directory Traversal vulnerability in SAP Commerce Cloud
MEDIUM (5.3)
SAP Commerce Cloud contains a path traversal vulnerability that may allow users to access web applications such as the Administration Console from addresses where the Administration Console is not explicitly deployed. This could potentially bypass configured access restrictions, resulting in a low impact on confidentiality, with no impact on the integrity or availability of the application.
Published: 2025-10-14T00:17:48.076Z
Updated: 2025-10-14T15:23:19.287Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-27435 |
vulnerable | 2026-06-08 07:14:54.931908 |
Information Disclosure Vulnerability in SAP Commerce Cloud
MEDIUM (4.2)
Under specific conditions and prerequisites, an unauthenticated attacker could access customer coupon codes exposed in the URL parameters of the Coupon Campaign URL in SAP Commerce. This could allow the attacker to use the disclosed coupon code, hence posing a low impact on confidentiality and integrity of the application.
Published: 2025-04-08T07:13:49.402Z
Updated: 2025-04-08T13:28:27.656Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-47577 |
vulnerable | 2026-06-08 06:48:12.888076 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-33003 |
vulnerable | 2026-06-08 06:37:24.998525 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-42481 |
vulnerable | 2026-06-08 06:11:08.156393 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-33666 |
vulnerable | 2026-06-08 05:32:12.059061 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21445 |
vulnerable | 2026-06-08 05:29:12.035967 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6363 |
vulnerable | 2026-06-08 05:26:45.167551 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-6272 |
vulnerable | 2026-06-08 05:26:44.979040 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-26809 |
vulnerable | 2026-06-08 05:23:51.510391 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.