NetWeaver vulnerabilities | LiveThreat CVE Feed

Product

NetWeaver

by SAP · last CVE Feb 10, 2026

On CISA KEVExploited in the wildRansomware-linked

109

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities109 In the news0 Timeline

Severity mix

Critical 11High 21Medium 27Low 2

Severity

All severities109 Critical11 High21 Medium27 Low2

Exploitation

On CISA KEV10 Exploited in the wild10

Watch

Add NetWeaver to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2012-1291	–	1%	Feb 23	Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter… Affected: 7.0
CVE-2012-1290	–	1%	Feb 23	Cross-site scripting (XSS) vulnerability in b2b/auction/container.jsp in the Internet Sales (crm.b2b) module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web… Affected: 7.0
CVE-2012-1289	–	2%	Feb 23	Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a Affected: 7.0
CVE-2011-4707	–	1%	Dec 8	Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the (1) instname… Affected: All versions, or not specified
CVE-2010-2904	–	1%	Jul 28	Multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary… Affected: 6.4; 7.0
CVE-2010-1609	–	1%	Apr 29	Cross-site scripting (XSS) vulnerability in SAP NetWeaver 2004 before SP21 and 2004s before SP13 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 4.0; 7.0
CVE-2009-2932	–	2%	Aug 21	Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web… Affected: 7.0
CVE-2008-3358	–	2%	Jan 28	Cross-site scripting (XSS) vulnerability in Web Dynpro (WD) in the SAP NetWeaver portal, when Internet Explorer 7.0.5730 is used, allows remote attackers to inject arbitrary web… Affected: All versions, or not specified
CVE-2008-1846	–	1%	Apr 16	The default configuration of SAP NetWeaver before 7.0 SP15 does not enable the "Always Use Secure HTML Editor" (aka Editor Security or Secure Editing) parameter, which allows… Affected: through 7.0