CVE-2016-2386

critical

Description

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

References

Exploits
More

https://www.exploit-db.com/exploits/43495/

https://www.exploit-db.com/exploits/39840/

https://github.com/murataydemir/CVE-2016-2386

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386

https://github.com/vah13/SAP_exploit

https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-3470

https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/

https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/

http://seclists.org/fulldisclosure/2016/May/56

http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.html

Details

Source: Mitre, NVD

Published: 2016-02-16

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.71522

Detections

Analytics