CVE-2015-7241

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Sep 6, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-72426.1Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbCVE-2015-72437.5Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary cCVE-2015-72447.5The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authCVE-2015-72457.5Directory traversal vulnerability in D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 allows remote attackers to read CVE-2015-72469.8D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the twCVE-2015-72479.8D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes CVE-2015-72487.5ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the CVE-2015-72494.9ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a moCVE-2015-72507.5Absolute path traversal vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attackCVE-2015-72519.8ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE have a hardcoded password of root for the root account, which allows remote attaCVE-2015-72526.1Cross-site scripting (XSS) vulnerability in cgi-bin/webproc on ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allows remote attCVE-2015-725310.0The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a coo
CVE-2015-7241: Critical severity, CVSS 9.8 | Vulnix