Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2025-42947Code Injection vulnerability in SAP FICA ODN framework

Description

SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be executed by the application. An attacker could thereby control the behaviour of the application causing high impact on integrity, low impact on availability and no impact on confidentiality of the application.

Timeline

  1. ID reserved

    By sap

  2. · 3 months later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-42947, by who scored it
Scored byCVSSScoreVector
sapCNA (assigner)3.1Medium5.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
NVDNVD · Deferred3.1Medium5.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
EPSS (exploitation in 30 days)
0.36% · top 70% of all CVEs (15 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Affected products

  • SAP_SE · SAP FICA ODN framework

    • affected SAPSCORE 132
    • affected S4CORE 102
    • affected 103
    • affected 104
    • affected 105
    • affected 106
    • affected 107
    • affected 108
    • affected FI-CA 606
    • affected 616
    • affected 617
    • affected 618

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-42947 badge
[![CVE-2025-42947](https://cveledger.app/badge/CVE-2025-42947.svg)](https://cveledger.app/cve/CVE-2025-42947)

Record last updated .