CVE-2025-42993 CVSS:6.7

SAP S/4HANA (Enterprise Event Enablement) could allow a remote authenticated attacker to execute arbitrary code on the system, caused by missing authorization validation.

CVE-2025-42991 CVSS:4.3

SAP S/4HANA (Bank Account Application) could allow a remote authenticated attacker to delete attachment from bank account application of other user, caused by missing authorization validation.

CVE-2025-42989 CVSS:9.8

SAP NetWeaver Application Server for ABAP could allow a remote authenticated attacker to gain elevated privileges on the system, caused by missing authorization validation.

CVE-2025-42988 CVSS:3.7

SAP Business Objects Business Intelligence Platform is vulnerable to server-side request forgery, caused by improper validation of HTTP requests.

CVE-2025-42987 CVSS:4.3

SAP S/4HANA (Manage Processing Rules - For Bank Statement) could allow a remote authenticated attacker to edit shared rules of any user, caused by missing authorization validation.

CVE-2025-42984 CVSS:5.4

SAP S/4HANA (Manage Central Purchase Contract application) could allow a remote authenticated attacker to execute the function import on the entity making it inaccessible for unrestricted user, caused by missing authorization validation.