CVE-2025-42916

HighCVSS 8.1/10Last modified Sep 30, 2026

Description

Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability of the database but no impact on confidentiality.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-1287

Affected software

No affected versions have been published.

Timeline

Published
Sep 9, 2025
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-429176.5SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escCVE-2025-429184.3SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access tCVE-2025-429195.3Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipCVE-2025-42925.4A vulnerability has been found in MRCMS 3.1.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of tCVE-2025-429206.1Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a CVE-2025-429216.5In JetBrains Toolbox App before 2.6 host key verification was missing in SSH pluginCVE-2025-429229.9SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitCVE-2025-429234.3Due to insufficient CSRF protection in SAP Fiori App Manage Work Center Groups, an authenticated user could be tricked by an attacker to senCVE-2025-429246.1SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redCVE-2025-429254.3Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low CVE-2025-429265.3SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within theCVE-2025-429273.4SAP NetWeaver AS Java application uses Adobe Document Service, installed with a vulnerable version of OpenSSL.Successful exploitation of kno
CVE-2025-42916: High severity, CVSS 8.1 | Vulnix