CVE-2025-42981— Multiple vulnerabilities in SAP NetWeaver Application Server ABAP
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-42981
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple vulnerabilities in SAP NetWeaver Application Server ABAP
Source: NVD (National Vulnerability Database)
Vulnerability Description
Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a victim clicks on this link, the script executes within the victim's browser, redirecting them to a site controlled by the attacker. This allows the attacker to access and/or modify restricted information related to the web client. While the vulnerability poses no impact on data availability, it presents a considerable risk to confidentiality and integrity.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: NVD (National Vulnerability Database)
Vulnerability Title
SAP NetWeaver Application Server ABAP 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP NetWeaver Application Server ABAP是德国思爱普（SAP）公司的一个运行和开发基于ABAP语言的应用程序的平台。 SAP NetWeaver Application Server ABAP存在输入验证错误漏洞，该漏洞源于开放重定向，可能导致浏览器执行恶意脚本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server ABAP | SAP_BASIS 700 | - |
II. Public POCs for CVE-2025-42981
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-42981
请登录查看更多情报信息。
Same Patch Batch · SAP_SE · 2025-07-08 · 27 CVEs total
| CVE-2025-42967 | 9.9 CRITICAL | Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation) |
| CVE-2025-42980 | 9.1 CRITICAL | Insecure Deserialization in SAP NetWeaver Enterprise Portal Federated Portal Network |
| CVE-2025-42963 | 9.1 CRITICAL | Insecure Deserialization in SAP NetWeaver Application Server for Java (Log Viewer ) |
| CVE-2025-42964 | 9.1 CRITICAL | Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration |
| CVE-2025-42966 | 9.1 CRITICAL | Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service) |
| CVE-2025-42953 | 8.1 HIGH | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2025-42959 | 8.1 HIGH | Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476 |
| CVE-2025-42952 | 7.7 HIGH | Missing Authorization check in SAP Business Warehouse and SAP Plug-In Basis |
| CVE-2025-42992 | 6.9 MEDIUM | Multiple Privilege Escalation Vulnerabilities in SAPCAR |
| CVE-2025-43001 | 6.9 MEDIUM | Multiple Privilege Escalation Vulnerabilities in SAPCAR |
| CVE-2025-42969 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP |
| CVE-2025-42985 | 6.1 MEDIUM | Open Redirect vulnerability in SAP BusinessObjects Content Administrator workbench |
| CVE-2025-42962 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Business Warehouse (Business Explorer Web |
| CVE-2025-42970 | 5.8 MEDIUM | Directory Traversal vulnerability in SAPCAR |
| CVE-2025-42979 | 5.6 MEDIUM | Insecure Key & Secret Management vulnerability in SAP GUI for Windows |
| CVE-2025-42973 | 5.4 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report) |
| CVE-2025-42968 | 5.0 MEDIUM | Missing Authorization check in SAP NetWeaver (RFC enabled function module) |
| CVE-2025-42961 | 4.9 MEDIUM | Missing Authorization check in SAP NetWeaver Application Server for ABAP |
| CVE-2025-42974 | 4.3 MEDIUM | Missing Authorization Check in SAP NetWeaver and ABAP Platform (SDCCN) |
| CVE-2025-42960 | 4.3 MEDIUM | Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA BEx Tools |
Showing top 20 of 27 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: SAP NetWeaver Application Server ABAP
- CVE-2026-34257
Open Redirect vulnerability in SAP NetWeaver Application Ser - CVE-2025-42945
HTML Injection vulnerability in SAP NetWeaver Application Se - CVE-2025-42956
Multiple vulnerabilities in SAP NetWeaver Application Server - CVE-2025-23186
Mixed Dynamic RFC Destination vulnerability through Remote F - CVE-2025-25242
Cross-Site Scripting (XSS) in SAP NetWeaver Application Serv
Same vendor: SAP_SE
- CVE-2026-34264
Information Disclosure vulnerability in SAP Human Capital Ma - CVE-2026-34262
Information Disclosure Vulnerability in SAP HANA Cockpit and - CVE-2026-34261
Missing Authorization check in SAP Business Analytics and SA - CVE-2026-34257
Open Redirect vulnerability in SAP NetWeaver Application Ser - CVE-2026-34256
Missing Authorization check in SAP ERP and SAP S/4 HANA (Pri
Same weakness: CWE-601
- CVE-2026-42350
Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Qu - CVE-2026-42195
Unvalidated gitlab URL parameter redirects OAuth authorize s - CVE-2026-3318
Multiple vulnerabilities in Cradle e-commerce - CVE-2026-42259
Saltcorn: Open Redirect in `POST /auth/login` due to incompl - CVE-2026-6795
Open Redirect in DivvyDrive Information Technologies' DivvyD
V. Comments for CVE-2025-42981
No comments yet