Known vulnerabilities in SAP NetWeaver Enterprise Portal

Vendor: SAP
Software: SAP NetWeaver Enterprise Portal
Software CPE: cpe:2.3:a:sap:sap_netweaver_enterprise_portal:*:*:*:*:*:*:*:*
Website: https://www.sap.com/
Total vulnerabilities: 13
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting SAP NetWeaver Enterprise Portal SAP NetWeaver Enterprise Portal is affected by 13 known vulnerabilities: 1 high, 5 medium, 7 low Critical High Medium Low

Vulnerabilities (13)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU123664 - Deserialization of Untrusted Data
CVE-2026-27685		 CWE-502 Low
No
No
 - 10.03.2026 -
#VU121198 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-0499		 CWE-79 Low
No
No
 - 13.01.2026 -
#VU119392 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-42872		 CWE-79 Low
No
No
 - 09.12.2025 -
#VU118672 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-42884		 CWE-94 Medium
No
No
 - 21.11.2025 -
#VU105497 - Improper Access Control
CVE-2025-23194		 CWE-284 Medium
No
No
 - 11.03.2025 -
#VU98133 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-47594		 CWE-79 Low
No
No
 - 08.10.2024 -
#VU96983 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-44120		 CWE-79 Low
No
No
 - 10.09.2024 -
#VU78643 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2023-33985		 CWE-79 Low
No
No
 - 25.07.2023 -
#VU75129 - Missing Authentication for Critical Function
CVE-2023-28761		 CWE-306 Medium
No
No
 - 14.04.2023 -
#VU56493 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-21489		 CWE-79 Low
No
No
 - 14.09.2021 -
#VU55676 - Server-Side Request Forgery (SSRF)
CVE-2021-33705		 CWE-918 High
No
No
 - 10.08.2021 -
#VU55675 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-33703		 CWE-79 Medium
No
No
 - 10.08.2021 -
#VU55674 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-33702		 CWE-79 Medium
No
No
 - 10.08.2021 -