SAP ERP 103

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Published: 2026-02-10T03:01:08.999Z
Updated: 2026-02-26T15:04:14.152Z

The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.

Published: 2023-10-10T01:37:36.327Z
Updated: 2024-09-28T22:13:00.204Z

SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity.

Published: 2023-09-08T21:05:24.877Z
Updated: 2024-09-25T20:04:01.418Z

Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the database. This leads to an impact on the integrity of the data.

Published: 2022-07-12T20:27:22.000Z
Updated: 2024-08-03T07:39:51.053Z

Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to low impact on confidentiality and integrity of the data.

Published: 2022-07-12T20:27:00.000Z
Updated: 2024-08-03T07:25:59.513Z