CVE-2025-42971 CVSS:4

SAP SAPCAR could allow a local authenticated attacker to execute arbitrary code on the system, caused by a memory corruption flaw.

CVE-2025-42970 CVSS:5.8

SAP SAPCAR could allow a local authenticated attacker to traverse directories on the system to overwrite arbitrary files in unintended locations.

CVE-2025-42969 CVSS:6.1

SAP NetWeaver Application Server ABAP and ABAP Platform is vulnerable to cross-site scripting, caused by improper validation of user-supplied input.

CVE-2025-42968 CVSS:5

SAP NetWeaver (RFC enabled function module) could allow a remote authenticated attacker to obtain non-sensitive information about the SAP system and OS, caused by improper authorization validation.

CVE-2025-42965 CVSS:4.1

SAP BusinessObjects BI Platform Central Management Console Promotion Management Application is vulnerable to server-side request forgery, caused by improper input validation during job source configuration.