CVE-2016-6256: SAP Business One

Critical severity, CVSS 9.6. EPSS: 7.9% chance of exploitation in the next 30 days.

SAP Business One for Android 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to B1iXcellerator/exec/soap/vP.001sap0003.in_WCSX/com.sap.b1i.vplatform.runtime/INB_WS_CALL_SYNC_XPT/INB_WS_CALL_SYNC_XPT.ipo/proc, aka SAP Security Note 2378065.

Affected products

• SAP Business One: version 1.2.3 only

Published 2017-05-26. Last modified 2026-06-17.