# Sap Netweaver


- [CVE-2025-31324](https://insights.sbomify.com/CVE-2025-31324/): SAP NetWeaver Unrestricted File Upload (critical 10.0, exploited in the wild)
- [CVE-2021-38163](https://insights.sbomify.com/CVE-2021-38163/): SAP NetWeaver Unrestricted File Upload (critical 9.9, exploited in the wild)
- [CVE-2025-42999](https://insights.sbomify.com/CVE-2025-42999/): SAP NetWeaver Deserialization (critical 9.1, exploited in the wild)
- [CVE-2013-6822](https://insights.sbomify.com/CVE-2013-6822/): XML external entity in n/a (critical 10.0)
- [CVE-2011-1517](https://insights.sbomify.com/CVE-2011-1517/): Memory corruption in n/a (critical 9.8)
- [CVE-2013-1592](https://insights.sbomify.com/CVE-2013-1592/): Memory corruption in n/a (critical 9.8)
- [CVE-2015-7241](https://insights.sbomify.com/CVE-2015-7241/): XML external entity in n/a (critical 9.8)
- [CVE-2016-10311](https://insights.sbomify.com/CVE-2016-10311/): Memory corruption in n/a (critical 9.8)
- [CVE-2021-21481](https://insights.sbomify.com/CVE-2021-21481/): Missing authorization in SAP NetWeaver AS JAVA (MigrationService) (critical 9.6)
- [CVE-2012-2611](https://insights.sbomify.com/CVE-2012-2611/): Code injection in n/a (critical 9.3)
- [CVE-2023-36922](https://insights.sbomify.com/CVE-2023-36922/): OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL) (critical 9.1)
- [CVE-2020-6203](https://insights.sbomify.com/CVE-2020-6203/): Path traversal in SAP NetWeaver UDDI Server (Services Registry) (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/products/sap/netweaver/