CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
SAP NetWeaver Visual Composer Metadata Uploader Deserialization Vulnerability (CVE-2025-42999) Analysis and Mitigation Guide
[Affected Scope] Systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader module
[Impact] A privileged attacker can upload untrusted or malicious content, triggering deserialization of untrusted data (CWE-502) and potentially compromising the confidentiality, integrity, and availability of the host system
[Mitigation] Immediately apply the official security patch (SAP Note 3604119) and restrict access to unauthorized metadata upload endpoints
SAP NetWeaver Visual Composer Metadata Uploader Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2025-31324)
[Affected Scope] SAP systems utilizing the SAP NetWeaver Visual Composer Metadata Uploader component.
[Impact] Unauthenticated remote attackers can upload malicious executable binaries (such as web shells), leading to complete compromise of system confidentiality, integrity, and availability.
[Mitigation] Immediately apply the official security patch (SAP Note 3594142) and restrict external access to the Metadata Uploader endpoints.
SAP NetWeaver Application Server Java Directory Traversal Arbitrary File Read (CVE-2017-12637) Analysis and Mitigation Guide
[Affected Scope] SAP NetWeaver Application Server Java version 7.5.
[Impact] Unauthenticated remote attackers can read arbitrary system and configuration files by exploiting a directory traversal vulnerability using '..' sequences in the query string.
[Mitigation] Apply SAP Security Note 2486657 immediately, and implement WAF rules to block directory traversal patterns in the interim.