CVE-2025-42880

CriticalCVSS 9.9/10Last modified Oct 7, 2026

Description

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
SAP_SE	SAP Solution Manager	ST 720

References

Timeline

Published: Dec 9, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-428824.3Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could exe CVE-2025-428832.7Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with admini CVE-2025-428846.5SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI look CVE-2025-428855.8Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled function that will enable t CVE-2025-428866.1Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could generate a maliciou CVE-2025-428879.9Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enable CVE-2025-428885.5SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information stored in process m CVE-2025-428895.4SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a resu CVE-2025-42899.8A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO Co CVE-2025-4289010.0SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing att CVE-2025-428915.5Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents of CVE-2025-428926.8Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent ne