S4core

Vendor:

First CVE: May 9, 2018 · Active for 8 years

13

Total CVEs

More Total CVEs than 91% of tracked products

2.2

Avg CVEs / Year

Higher CVE frequency than 73% of tracked products

6.1

Avg CVSS

Higher Avg CVSS than 21% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact S4core over time

Volume of CVEsAvg CVSS Base Score

First CVE

May 9, 2018

8 years ago

Most Recent CVE

Feb 10, 2026

166 days ago

CVE Severity & Scoring

S4core13 CVEs

77%

15%

All CVEs352,719 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local1 (7.7%)

Network12 (92.3%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low13 (100.0%)

High0 (0.0%)

Unknown0 (0.0%)

User Interaction

None8 (61.5%)

Unknown0 (0.0%)

Required5 (38.5%)

Privileges Required

Low9 (69.2%)

High1 (7.7%)

None3 (23.1%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (13 CVEs).

13 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2021-33701CRITICAL DMIS Mobile Plug-In or SAP S/4HANA, versions - DMIS 2011_1_620, 2011_1_640, 2011_1_700, 2011_1_710, 2011_1_730, 710, 2011_1_731, 710, 2011_1_752, 2020, SAPSCORE 125, S4CORE 102, 10	Sep 15, 2021	9.1	29	NO	NO
CVE-2018-2484HIGH SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0; Bank/	Jan 8, 2019	8.8	28	NO	NO
CVE-2024-39592MEDIUM Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive info	Jul 9, 2024	6.5	21	NO	NO
CVE-2023-35870HIGH When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change	Jul 11, 2023	7.3	21	NO	NO
CVE-2026-24323MEDIUM The BSP applications allow an unauthenticated user to inject malicious script content via user-controlled URL parameters that are not sufficiently sanitized. When a victim accesses	Feb 10, 2026	6.1	19	NO	NO
CVE-2026-0505MEDIUM The BSP applications allow an unauthenticated user to manipulate user-controlled URL parameters that are not sufficiently validated. This could result in unvalidated redirection to	Feb 10, 2026	6.1	19	NO	NO
CVE-2023-32112MEDIUM Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618, S4COR	May 9, 2023	5.5	19	NO	NO
CVE-2023-29110MEDIUM The SAP Application Interface (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 100, 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows the usage HTML tags.	Apr 11, 2023	5.4	19	NO	NO
CVE-2023-29109MEDIUM The SAP Application Interface Framework (Message Dashboard) - versions AIF 703, AIFX 702, S4CORE 101, SAP_BASIS 755, 756, SAP_ABA 75C, 75D, 75E, application allows an Excel formula	Apr 11, 2023	4.6	18	NO	NO
CVE-2018-2419MEDIUM SAP Enterprise Financial Services (SAPSCORE 1.11, 1.12; S4CORE 1.01, 1.02; EA-FINSERV 6.04, 6.05, 6.06, 6.16, 6.17, 6.18, 8.0) does not perform necessary authorization checks for a	May 9, 2018	4.6	18	NO	NO

View all 13 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (13 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (13 CVEs).

Media Mentions

Signals from CVEs in this product scope (13 CVEs).

Top CNAs Publishing CVEs For S4core

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
108	3	5.9	0.2%
107	6	5.8	0.3%
106	5	5.8	0.3%
105	6	6.4	0.6%
104	6	6.4	0.6%
1.03	1	8.8	1.4%
103	6	6.3	0.6%
1.02	2	6.7	1.1%
102	6	6.3	0.6%
1.01	2	6.7	1.1%
101	2	5.0	0.3%
100	2	5.5	0.2%