Supplier Relationship Management vulnerabilities | LiveThreat CVE Feed

Product

Supplier Relationship Management

by Sap · last CVE Jan 13, 2026

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities11 In the news0 Timeline

Severity mix

Critical 1High 1Medium 7Low 0

Severity

All severities11 Critical1 High1 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Supplier Relationship Management to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2025-30012	9.8	1%	May 13	The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload… Affected: 7.14
CVE-2025-30018	7.5	0%	May 13	The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which… Affected: 7.14
CVE-2025-42920	6.1	0%	Sep 9	Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly… Affected: 7.0
CVE-2025-30010	6.1	0%	May 13	The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated… Affected: 7.14
CVE-2025-30009	6.1	0%	May 13	he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated… Affected: 7.14
CVE-2019-0361	6.1	1%	Sep 10	SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs,… Affected: 3.73; 7.31; 7.32
CVE-2023-39436	5.8	0%	Aug 8	SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master… Affected: 600; 602; 603; 604; 605; 606; +2 more
CVE-2025-30011	5.3	0%	May 13	The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated… Affected: 7.14
CVE-2026-0513	4.7	0%	Jan 13	Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) Affected: 700; 701; 702; 713; 714
CVE-2014-4161	–	1%	Jun 13	Cross-site scripting (XSS) vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to inject arbitrary web script or HTML via the… Affected: All versions, or not specified
CVE-2014-4159	–	1%	Jun 13	Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to redirect users to arbitrary web sites and conduct… Affected: All versions, or not specified