SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO) (SAP_SE SAP S/4HANA Project Management (PPM-PRO))
At a glance
- Source
- NVD
- EPSS
- EPSS 0.31 % · percentile 24 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Awaiting Analysis
Description
SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application.
Weaknesses (CWE)
- CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L | sap |
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L | NVD · cna@sap.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-43593
- GCVE · GCVE-0-2026-44769
CERT-FR advisories
- CERTFR-2026-AVI-0877 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP S/4HANA Project Management (PPM-PRO) | affected SAP_APPL 600 ; affected 602 ; affected 603 ; affected 604 ; affected 605 ; affected 606 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |