CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
SAP NetWeaver Visual Composer Metadata Uploader Deserialization Vulnerability (CVE-2025-42999) Analysis and Mitigation Guide
[Affected Scope] Systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader module
[Impact] A privileged attacker can upload untrusted or malicious content, triggering deserialization of untrusted data (CWE-502) and potentially compromising the confidentiality, integrity, and availability of the host system
[Mitigation] Immediately apply the official security patch (SAP Note 3604119) and restrict access to unauthorized metadata upload endpoints
SAP NetWeaver Java Application Server Invoker Servlet Authentication Bypass Remote Code Execution (CVE-2010-5326)
[Affected Scope] SAP NetWeaver Application Server Java platforms, typically prior to version 7.3
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands and Java code via crafted HTTP/HTTPS requests (CVSS 10.0)
[Mitigation] Apply SAP Note 1445998 and disable the Invoker Servlet globally in the web.xml configuration