Known vulnerabilities in SAP Business One

Vendor: SAP
Software: SAP Business One
Software CPE: cpe:2.3:a:sap:sap_business_one:*:*:*:*:*:*:*:*
Website: https://www.sap.com/
Total vulnerabilities: 20
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.7

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting SAP Business One SAP Business One is affected by 20 known vulnerabilities: 1 high, 14 medium, 5 low Critical High Medium Low

Vulnerabilities (20)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU123673 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-0489		 CWE-79 Medium
No
No
 - 10.03.2026 SB2026031042
#VU118704 - Exposure of sensitive information to an unauthorized actor
CVE-2025-42897		 CWE-200 Medium
No
No
 - 24.11.2025 SB2025112429
#VU105498 - Missing Authorization
CVE-2025-26658		 CWE-862 Medium
No
No
 - 11.03.2025 SB2025031131
#VU83338 - Improper Access Control
CVE-2023-31403		 CWE-284 Medium
No
No
 - 21.11.2023 SB2023112118
#VU82046 - Externally-generated error message containing sensitive information
CVE-2023-41365		 CWE-211 Low
No
No
 - 16.10.2023 SB2023101625
#VU79281 - Improper Access Control
CVE-2023-37487		 CWE-284 Medium
No
No
 - 09.08.2023 SB2023080924
#VU79280 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2023-33993		 CWE-89 Medium
No
No
 - 09.08.2023 SB2023080924
#VU79279 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-39437		 CWE-79 Low
No
No
 - 09.08.2023 SB2023080924
#VU56497 - Exposure of sensitive information to an unauthorized actor
CVE-2021-37532		 CWE-200 Low
No
No
 - 14.09.2021 SB2021091415
#VU56496 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2021-33688		 CWE-89 Medium
No
No
 - 14.09.2021 SB2021091415
#VU56495 - Exposure of sensitive information to an unauthorized actor
CVE-2021-33686		 CWE-200 Medium
No
No
 - 14.09.2021 SB2021091415
#VU56494 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2021-33685		 CWE-22 Medium
No
No
 - 14.09.2021 SB2021091415
#VU55671 - Missing Authorization
CVE-2021-33704		 CWE-862 Medium
No
No
 - 10.08.2021 SB2021081002
#VU55670 - Missing Authentication for Critical Function
CVE-2021-33700		 CWE-306 Medium
No
No
 - 10.08.2021 SB2021081002
#VU55669 - Unrestricted Upload of File with Dangerous Type
CVE-2021-33698		 CWE-434 High
No
No
 - 10.08.2021 SB2021081002
#VU53863 - Exposure of sensitive information to an unauthorized actor
CVE-2021-33662		 CWE-200 Low
No
No
 - 08.06.2021 SB2021060802
#VU53064 - Exposure of sensitive information to an unauthorized actor
CVE-2021-27613		 CWE-200 Medium
No
No
 - 11.05.2021 SB2021051105
#VU53063 - Permissions, Privileges, and Access Controls
CVE-2021-27614		 CWE-264 Medium
No
No
 - 11.05.2021 SB2021051105
#VU53062 - Permissions, Privileges, and Access Controls
CVE-2021-27616		 CWE-264 Medium
No
No
 - 11.05.2021 SB2021051105
#VU17732 - Exposure of sensitive information to an unauthorized actor
CVE-2019-0256		 CWE-200 Low
No
No
 - 18.02.2019 SB2019021223