Currently exploited vulnerabilities

CVE ID	CVSS3.1	Exploitable	Vendor	Product	Vulnerability	Date added
CVE-2025-42999	9.1	True	SAP	NetWeaver	SAP NetWeaver Deserialization Vulnerability	2025-05-15 00:00:00
CVE-2025-31324	10.0	True	SAP	NetWeaver	SAP NetWeaver Unrestricted File Upload Vulnerability	2025-04-29 00:00:00
CVE-2017-12637	7.5	True	SAP	NetWeaver	SAP NetWeaver Directory Traversal Vulnerability	2025-03-19 00:00:00
CVE-2016-2388	5.3	True	SAP	NetWeaver	SAP NetWeaver Information Disclosure Vulnerability	2022-06-09 00:00:00
CVE-2016-2386	9.8	True	SAP	NetWeaver	SAP NetWeaver SQL Injection Vulnerability	2022-06-09 00:00:00
CVE-2021-38163	9.9	True	SAP	NetWeaver	SAP NetWeaver Unrestricted File Upload Vulnerability	2022-06-09 00:00:00
CVE-2016-3976	7.5	True	SAP	NetWeaver	SAP NetWeaver Directory Traversal Vulnerability	2021-11-03 00:00:00
CVE-2020-6287	10.0	True	SAP	NetWeaver	SAP NetWeaver Missing Authentication for Critical Function Vulnerability	2021-11-03 00:00:00
CVE-2016-9563	6.5	True	SAP	NetWeaver	SAP NetWeaver XML External Entity (XXE) Vulnerability	2021-11-03 00:00:00
CVE-2010-5326	10.0	True	SAP	NetWeaver	SAP NetWeaver Remote Code Execution Vulnerability	2021-11-03 00:00:00

AVET INS is an owner of VULNDBASE brand and website. This product uses data from the NVD API but is not endorsed or certified by the NVD. See NVD page for more information. CVE is a registered trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE site. CWE is a registered trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE page. KEV (Known Exploited Vulnerabilities) is a catalog maintained by CISA. EUVD is the official EU repository for timely, curated cybersecurity vulnerability intelligence and remediation guidance run by ENISA. DORA (Digital Operational Resilience Act) is and EU directive.