SAP NetWeaver (Visual Composer development server) vulnerabilities

2 known vulnerabilities in SAP NetWeaver (Visual Composer development server) from SAP. 2 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  SAP NetWeaver Deserialization Exploited

  CVE-2025-42999May 13, 2025SAPEPSS 12.9%

  SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.

• 9.8 Critical severity

  SAP NetWeaver Unrestricted File Upload Exploited

  CVE-2025-31324Apr 24, 2025SAPEPSS 99.5%

  SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confi