SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324) ยท updates https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324 A CVSS 10 missing-authorization flaw in the NetWeaver Visual Composer Metadata Uploader let anyone POST JSP webshells to /developmentserver/metadatauploader. ReliaQuest found it while investigating compromises; SAP shipped an emergency fix on April 24, 2025. en Thu, 15 May 2025 00:00:00 GMT SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324): CISA adds the related NetWeaver flaw CVE-2025-42999 to KEV https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324 https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324#2025-05-15-b40e6551 Thu, 15 May 2025 00:00:00 GMT critical <p>SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324): CISA adds the related NetWeaver flaw CVE-2025-42999 to KEV</p> SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324): CISA adds CVE-2025-31324 to KEV https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324 https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324#2025-04-29-d8edf2e2 Tue, 29 Apr 2025 00:00:00 GMT critical <p>SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324): CISA adds CVE-2025-31324 to KEV</p> SAP NetWeaver Visual Composer zero-day: unauthenticated webshell uploads (CVE-2025-31324): SAP releases an emergency fix; ReliaQuest publishes its findings https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324 https://pwn.watch/i/sap-netweaver-visual-composer-zero-day-cve-2025-31324#2025-04-24-9f9acd5a Thu, 24 Apr 2025 00:00:00 GMT critical <p><a href="https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/">Source</a></p>