SAP Supplier Relationship Management vulnerabilities

11 CVEs affecting SAP Supplier Relationship Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-0513, published 2026-01-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-4159, published 2014-06-13. Medium severity, CVSS 5.8. EPSS: 1.3% chance of exploitation in the next 30 days. Open redirect vulnerability in in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a…
CVE-2014-4161, published 2014-06-13. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in la/umTestSSO.jsp in SAP Supplier Relationship Management (SRM) allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVE-2025-30012, published 2025-05-13. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload request in a…
CVE-2019-0361, published 2019-09-10. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. SAP Supplier Relationship Management (Master Data Management Catalog - SRM_MDM_CAT, before versions 3.73, 7.31, 7.32) does not sufficiently encode user-controlled inputs, resulting in Cross-Site…
CVE-2023-39436, published 2023-08-08. Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days. SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business…
CVE-2025-30018, published 2025-05-13. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables…
CVE-2025-30011, published 2025-05-13. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to send an…
CVE-2025-30009, published 2025-05-13. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute…
CVE-2025-30010, published 2025-05-13. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to craft a…
CVE-2025-42920, published 2025-09-09. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Due to a Cross-Site Scripting (XSS) vulnerability in the SAP Supplier Relationship Management, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an…

Latest

CVE-2026-0513, published 2026-01-13. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a malicious URL that, if accessed by a victim,…