SAP ERP 104

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Published: 2026-02-10T03:01:08.999Z
Updated: 2026-02-26T15:04:14.152Z

The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.

Published: 2023-10-10T01:37:36.327Z
Updated: 2024-09-28T22:13:00.204Z

SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity.

Published: 2023-09-08T21:05:24.877Z
Updated: 2024-09-25T20:04:01.418Z

SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. This could allow an attacker to delete the data with a high impact to availability.

Published: 2023-02-14T03:17:59.139Z
Updated: 2025-03-20T20:30:54.464Z

Due to missing input validation in the Manage Checkbooks component of SAP S/4HANA - version 101, 102, 103, 104, 105, 106, an attacker could insert or edit the value of an existing field in the database. This leads to an impact on the integrity of the data.

Published: 2022-07-12T20:27:22.000Z
Updated: 2024-08-03T07:39:51.053Z