CVE Explorer
CVE-2026-34260
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL queries, which are then passed to the underlying database without proper validation or sanitization. Upon successful exploitation, an attacker may gain unauthorized access to sensitive database information and could potentially crash the a
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"SAP S/4HANA (SAP Enterprise Search for ABAP)","vendor":"SAP_SE","versions":[{"status":"affected","version":"SAP_BASIS 751"},{"status":"affected","version":"SAP_BASIS 752"},{"status":"affected","version":"SAP_BASIS 753"},{"status":"affected","version":"SAP_BASIS 754"},{"status":"affected","version":"SAP_BASIS 755"},{"status":"affected","version":"SAP_BASIS 756"},{"status":"affected","version":"SAP_BASIS 757"},{"status":"affected","version":"SAP_BASIS 758"},{"status":"affected","version":"SAP_BASIS 816"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:7466cf8082b97c13b660c3367d1e58e7400c000d2449641675bde30f60e3ec31 · sha256:bcbb6de4ae6e4423… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:7466cf8082b97c13b660c3367d1e58e7400c000d2449641675bde30f60e3ec31 · sha256:bcbb6de4ae6e4423… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-89","description":"CWE-89: Improper Neutralization of Special Elements used in an SQL Command","lang":"eng","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:7466cf8082b97c13b660c3367d1e58e7400c000d2449641675bde30f60e3ec31 · sha256:bcbb6de4ae6e4423… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"url":"https://me.sap.com/notes/3724838"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7466cf8082b97c13b660c3367d1e58e7400c000d2449641675bde30f60e3ec31 · sha256:bcbb6de4ae6e4423… · /containers/cna/references/0
{"url":"https://url.sap/sapsecuritypatchday"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7466cf8082b97c13b660c3367d1e58e7400c000d2449641675bde30f60e3ec31 · sha256:bcbb6de4ae6e4423… · /containers/cna/references/1
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.