CVE-2025-42889

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end database. As a result, this vulnerability has a low impact on the application's confidentiality and integrity but no impact on its availability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Nov 11, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-42899.8A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component RNTO CoCVE-2025-4289010.0SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attCVE-2025-428915.5Due to a missing authorization check in SAP Enterprise Search for ABAP, an attacker with high privileges may read and export the contents ofCVE-2025-428926.8Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent neCVE-2025-428936.1Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed bCVE-2025-428946.8Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could reCVE-2025-428956.9Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally authenticated user toCVE-2025-428965.4SAP BusinessObjects Business Intelligence Platform lets an unauthenticated remote attacker send crafted requests through the URL parameter tCVE-2025-428975.3Due to information disclosure vulnerability in anonymous API provided by SAP Business One (SLD), an attacker with normal user access could gCVE-2025-428994.3SAP S4CORE (Manage journal entries) does not perform necessary authorization checks for an authenticated user resulting in escalation of priCVE-2025-42909.8A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of tCVE-2025-429015.4SAP Application Server for ABAP allows an authenticated attacker to store malicious JavaScript payloads which could be executed in victim us
CVE-2025-42889: Medium severity, CVSS 5.4 | Vulnix