CVE-2025-42951

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.�As a result , it has a high impact on the confidentiality, integrity, and availability of the application.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
SAP_SE	SAP Business One (SLD)	B1_ON_HANA 10.0; SAP-M-BO 10.0

References

Timeline

Published: Aug 12, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-429527.7SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structur CVE-2025-429538.1SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of pri CVE-2025-429542.7SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function CVE-2025-429553.5Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted req CVE-2025-429566.1SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make pu CVE-2025-429579.9SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the CVE-2025-429589.1Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized CVE-2025-429598.1An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system mis CVE-2025-42964.7URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing. This issue affects B2B: befo CVE-2025-429604.3SAP Business Warehouse and SAP BW/4HANA BEx Tools allow an authenticated attacker to gain higher access levels than intended by exploiting i CVE-2025-429614.9Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit CVE-2025-429626.1SAP Business Warehouse (Business Explorer Web) allows an attacker to create a malicious link. If an authenticated user clicks on this link,