CVE-2025-31330

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Apr 8, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-313314.3SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require addCVE-2025-313327.1Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system couldCVE-2025-313334.3SAP S4CORE OData meta-data property is vulnerable to data tampering, due to which entity set could be externally modified by an attacker cauCVE-2025-313346.8Issue that bypasses the "Mark of the Web" security warning function for files when opening a symbolic link that points to an executable fileCVE-2025-313354.0The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely CVE-2025-313386.9A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remoCVE-2025-313395.3An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 throughCVE-2025-31348.8A vulnerability classified as critical has been found in code-projects Payroll Management System 1.0. This affects an unknown part of the fiCVE-2025-313409.9A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of WisCVE-2025-313429.3An unrestricted upload of file with dangerous type vulnerability in the upload file function of Galaxy Software Services Corporation Vitals CVE-2025-313438.8A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.2). The affected application is vulnerable to SQL injCVE-2025-313447.3Heap-based Buffer Overflow vulnerability in openEuler giflib on Linux. This vulnerability is associated with program files gif2rgb.C. This