CVE-2016-2386

Known Exploited (CISA KEV)CRITICAL

9.8

CVSS Severity Score

EPSS Score27.0850%

EPSS Percentile97.29th

Published2016年2月16日

Last Modified2026年4月21日

Vulnerability Description

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

Affected Platforms (CPE)

📦

Sap

Netweaver Application Server Java

= 7.40

References & Advisories

🔗 http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html

🔗 http://seclists.org/fulldisclosure/2016/May/56

🔗 https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/

🔗 https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/

🔗 https://github.com/vah13/SAP_exploit

🔗 https://www.exploit-db.com/exploits/39840/

🔗 https://www.exploit-db.com/exploits/43495/

🔗 http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html

Vulnerability Description

Affected Platforms (CPE)

Netweaver Application Server Java

References & Advisories

関連する脆弱性情報