SAP S/4HANA 106

An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a full database compromise with high impact on confidentiality, integrity, and availability.

Published: 2026-02-10T03:01:08.999Z
Updated: 2026-02-26T15:04:14.152Z

Manage Bank Statement ReProcessing Rules does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. By exploiting this vulnerability, an attacker can enable/disable the sharing rule of other users affecting the integrity of the application. Confidentiality and Availability are not affected.

Published: 2024-05-14T03:53:10.737Z
Updated: 2024-08-01T20:33:52.538Z

The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.

Published: 2023-10-10T01:37:36.327Z
Updated: 2024-09-28T22:13:00.204Z

S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application.

Published: 2023-10-10T01:36:20.097Z
Updated: 2025-02-27T20:46:26.323Z

SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insufficient URL validation. As a result, it may have a slight impact on confidentiality and integrity.

Published: 2023-09-08T21:05:24.877Z
Updated: 2024-09-25T20:04:01.418Z