Apr 24, 2025
1 new incident, 0 with updates.
Started
- ClosedCriticalPatched
SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324)
A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025.
SAP NetWeaver Visual ComposerClosed Apr 29, 2025