CVE-2016-2386

SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.

• CWE-89
• CWE-89

• http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/May/56Exploit, Mailing List, Third Party Advisory
• https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/Broken Link, Third Party Advisory
• https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/Broken Link, Third Party Advisory
• https://github.com/vah13/SAP_exploitExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/39840/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/43495/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/137129/SAP-NetWeaver-AS-JAVA-7.5-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/May/56Exploit, Mailing List, Third Party Advisory
• https://erpscan.io/advisories/erpscan-16-011-sap-netweaver-7-4-sql-injection-vulnerability/Broken Link, Third Party Advisory
• https://erpscan.io/press-center/blog/sap-security-notes-february-2016-review/Broken Link, Third Party Advisory
• https://github.com/vah13/SAP_exploitExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/39840/Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/43495/Exploit, Third Party Advisory, VDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-2386US Government Resource

Published

Feb 16, 2016

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2379The Mxit protocol uses weak encryption when encrypting user …
• CVE-2016-2380An information leak exists in the handling of the MXIT proto…
• CVE-2016-2381Perl might allow context-dependent attackers to bypass the t…7.5
• CVE-2016-2383The adjust_branches function in kernel/bpf/verifier.c in the…5.5
• CVE-2016-2384Double free vulnerability in the snd_usbmidi_create function…
• CVE-2016-2385Heap-based buffer overflow in the encode_msg function in enc…
• CVE-2016-2387Multiple cross-site scripting (XSS) vulnerabilities in the J…
• CVE-2016-2388The Universal Worklist Configuration in SAP NetWeaver AS JAV…5.3
• CVE-2016-2389Directory traversal vulnerability in the GetFileList functio…
• CVE-2016-2390The FwdState::connectedToPeer method in FwdState.cc in Squid…
• CVE-2016-2391The ohci_bus_start function in the USB OHCI emulation suppor…5
• CVE-2016-2392The is_rndis function in the USB Net device emulator (hw/usb…