{"id":"CVE-2025-42999","aliases":[],"url":"https://o3.security/vulnerability/CVE-2025-42999","summary":"SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a…","details":"SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.","published":"2025-05-13T00:17:43.710Z","modified":"2026-08-11T03:55:28.103Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"epss":{"score":0.13868,"percentile":0.96312,"asOf":"2026-09-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://me.sap.com/notes/3604119"},{"type":"WEB","url":"https://url.sap/sapsecuritypatchday"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-42999"},{"type":"WEB","url":"https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-11T03:55:28.103Z"}}