SAP SE SAP Business One Sld vulnerabilities

3 CVEs affecting SAP SE SAP Business One Sld, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-42897, published 2025-11-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-42951, published 2025-08-12. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.�As a result , it has a high…
CVE-2025-42933, published 2025-09-09. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of sensitive credentials within http…
CVE-2025-42897, published 2025-11-11. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Due to information disclosure vulnerability in anonymous API provided by SAP Business One (SLD), an attacker with normal user access could gain access to unauthorized information. As a result, it has…