Known vulnerabilities in SAP BusinessObjects Business Intelligence suite 2025

Vendor: SAP
Software: SAP BusinessObjects Business Intelligence suite
Version: 2025
Software CPE: cpe:2.3:a:sap:sap_businessobjects:*:*:*:*:*:*:*:*
Website: https://www.sap.com/
Total vulnerabilities: 19
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting SAP BusinessObjects Business Intelligence suite version 2025 SAP BusinessObjects Business Intelligence suite 2025 is affected by 19 vulnerabilities: 3 high, 7 medium, 9 low Critical High Medium Low

Vulnerabilities (19)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU125968 - Session Fixation
CVE-2026-24318		 CWE-384 Low
No
No
 - 14.04.2026 SB2026041495
#VU125969 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-27683		 CWE-79 Low
No
No
 - 14.04.2026 SB2026041495
#VU122530 - Improper input validation
CVE-2026-0485		 CWE-20 Medium
No
No
 - 10.02.2026 SB2026021031
#VU122529 - Improper input validation
CVE-2026-0490		 CWE-20 Medium
No
No
 - 10.02.2026 SB2026021031
#VU119395 - Server-Side Request Forgery (SSRF)
CVE-2025-42896		 CWE-918 High
No
No
 - 09.12.2025 SB2025120917
#VU118877 - Resource exhaustion
CVE-2025-64775		 CWE-400 Medium
No
No
 - 01.12.2025 SB2025120157
SB2026012180
SB2026021948
and 4 more
#VU112257 - Improper input validation
CVE-2025-31672		 CWE-20 Medium
No
No
 - 04.07.2025 SB20250704104
SB2025070708
SB2025071664
and 23 more
#VU110690 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-23192		 CWE-79 Low
No
No
 - 10.06.2025 SB2025061015
#VU109029 - Exposure of sensitive information to an unauthorized actor
CVE-2025-43000		 CWE-200 Low
No
No
 - 13.05.2025 SB2025051331
#VU105502 - Exposure of sensitive information to an unauthorized actor
CVE-2025-23185		 CWE-200 Low
No
No
 - 11.03.2025 SB2025031134
#VU105501 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-25245		 CWE-79 Low
No
No
 - 11.03.2025 SB2025031134
#VU105500 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-0062		 CWE-79 Low
No
No
 - 11.03.2025 SB2025031134
#VU103765 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-24867		 CWE-79 Low
No
No
 - 11.02.2025 SB2025021149
#VU103764 - Improper Authorization
CVE-2025-0064		 CWE-285 Low
No
No
 - 11.02.2025 SB2025021149
#VU102591 - Improper input validation
CVE-2025-0060		 CWE-20 High
No
No
 - 14.01.2025 SB2025011429
#VU102590 - Improper input validation
CVE-2025-0061		 CWE-20 High
No
No
 - 14.01.2025 SB2025011429
#VU101377 - Unrestricted Upload of File with Dangerous Type
CVE-2024-42375		 CWE-434 Medium
No
No
 - 10.12.2024 SB2024121011
#VU101376 - Exposure of sensitive information to an unauthorized actor
CVE-2024-32732		 CWE-200 Medium
No
No
 - 10.12.2024 SB2024121011
#VU98124 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-37179		 CWE-22 Medium
No
No
 - 08.10.2024 SB2024100805