Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Unauthenticated authentication-bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 lets a remote attacker reach protected data over HTTP without credentials. Because the scope changes, a successful attack can pivot beyond OAM itself and compromise other products that rely on it for single sign-on, exposing critical data across the integrated environment. No public exploit identified at time of analysis; Oracle addressed the flaw in its July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker reach and read all data accessible to the application over HTTP, with a scope change that can significantly impact other connected products. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 score of 8.6 driven entirely by confidentiality impact. No public exploit is identified at time of analysis, and it is fixed in the Oracle Critical Patch Update of July 2026.
Unauthorized data access in Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows a remote, unauthenticated attacker to reach all data accessible to the product over HTTP. The flaw carries a scope change, meaning a successful attack can significantly impact additional connected products beyond WebCenter Sites itself. Oracle rates it CVSS 3.1 8.6 (confidentiality-only); no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle tags it as an Authentication Bypass.
Unauthorized data disclosure in Oracle Identity Manager Connector (Oracle Fusion Middleware, PeopleSoft Applications component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to reach critical data over HTTP, with a scope change (S:C) meaning the impact extends to additional connected products beyond the connector itself. The vendor rates it CVSS 8.6 with confidentiality-only impact and low attack complexity, and tags indicate an authentication-bypass class weakness. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, so risk is currently based on the vendor's own severity assessment via the July 2026 Critical Patch Update.
Unauthorized data access in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a remote unauthenticated attacker reach critical directory data over HTTP, with a scope change that can spill impact into other products relying on the directory. Oracle rates it CVSS 3.1 8.6 with high confidentiality impact and no integrity or availability effect, and tags it as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated authentication-bypass in Oracle Access Manager (Fusion Middleware Authentication Engine, versions 12.2.1.4.0 and 14.1.2.1.0) lets a remote attacker over HTTP compromise the identity/SSO tier and read all data it can access. Because of a CVSS scope change, successful attacks can significantly impact other products that rely on OAM for authentication, magnifying the blast radius. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; risk is driven by the low-complexity, no-authentication network vector (CVSS 3.1 base 8.6).
Unauthorized data disclosure in Oracle WebLogic Server (WLS Web Services component) lets an unauthenticated remote attacker read all data accessible to the server over HTTP, with a scope change that can significantly impact additional products beyond WebLogic itself. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.6 (confidentiality-only) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Denial-of-service with data tampering in Oracle Coherence 15.1.1.0.0 (Fusion Middleware Core) lets an unauthenticated network attacker hang or repeatedly crash the in-memory data grid over TCP, while also gaining limited unauthorized read and write access to a subset of grid-managed data. Rated CVSS 3.1 8.6 by Oracle and described as 'easily exploitable,' the flaw requires no authentication or user interaction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, with a scope change that can significantly impact other Oracle products relying on it for single sign-on. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 score of 8.6 and is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (Oracle Fusion Middleware, mod_proxy component) lets an unauthenticated remote attacker over HTTP read critical data and, because of a scope change, reach data belonging to other back-end products the proxy fronts. The confidentiality-only impact combined with S:C strongly indicates a proxy-side request-forwarding/SSRF-class weakness that exposes internal resources rather than a code-execution flaw. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service and limited data tampering in Oracle Business Intelligence Enterprise Edition (BI Platform Security component, versions 8.2.0.0.0 and 26.01.0.0.0) lets an unauthenticated remote attacker over HTTP hang or repeatedly crash the server (complete DOS) and perform limited unauthorized read, insert, update, or delete of accessible data. Oracle rates it CVSS 3.1 8.6 and describes it as easily exploitable with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection and security-boundary bypass in Google's MCP Toolbox for Databases (googleapis/mcp-toolbox) lets a low-privileged MCP client abuse the prebuilt BigQuery forecasting tool (bigquery-forecast) to read arbitrary BigQuery tables. The tool interpolates client-supplied column parameters (data_col, timestamp_col, id_cols) unescaped into a generated AI.FORECAST SELECT statement, and the operator-configured allowedDatasets guard only validates the history_data parameter - not the final assembled query - so an attacker breaks out of a string literal to reach datasets that should be off-limits. There is no public exploit identified at time of analysis; risk derives from the injection primitive plus the confidentiality impact of cross-dataset reads.
Full compromise of Oracle Product Hub (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated, low-privileged attacker with HTTP network access to take over the product and, because of a scope change, significantly impact additional connected products. The flaw was disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 8.5, though the vector rates it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-escalation-to-takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (OIM Legacy UI component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability impact, though the AC:H metric marks it as difficult to exploit. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle Coherence (Fusion Middleware Core) is possible by a low-privileged network attacker over TCP in supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with a scope change that can significantly impact additional co-located products beyond Coherence itself. Rated CVSS 3.1 8.5 with high confidentiality, integrity and availability impact, though the high attack complexity means exploitation is not trivial. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation and full component takeover affects Oracle Contracts Integration within Oracle E-Business Suite (Internal Operations component), versions 12.2.3 through 12.2.15, where a low-privileged, network-authenticated attacker can compromise the component and, due to a scope change (S:C), significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability loss, though the attack is flagged as difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege-abusing information disclosure and data tampering in Oracle WebCenter Content: Imaging (Core component) lets a low-privileged, network-based attacker read all Imaging-accessible data and modify some of it over HTTP. The flaw carries a scope change (CVSS 8.5), meaning a successful attack can reach beyond the Imaging module into other Fusion Middleware components, and Oracle tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.
Sensitive data disclosure and partial data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, network-based attacker over HTTP to gain complete read access to all data the product can reach and to modify some of that data. Oracle rates the flaw CVSS 3.1 8.5 with a scope change, meaning exploitation can significantly impact adjacent products beyond WebCenter Content itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so treat this as a high-severity but not confirmed-exploited issue.
Privilege escalation and cross-product data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core) lets a low-privileged network attacker abuse the LDAP interface to gain complete read access to all directory-accessible data and partial write access. Vendor-tagged as an authentication bypass with a scope change, meaning successful attacks can significantly impact other products that rely on this directory. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the CVSS 3.1 base score of 8.5 with 'easily exploitable' vendor language marks it as a high-priority patch.
Full takeover of Oracle MySQL Connector/Net (versions 9.7.0 and 9.7.1) is possible by a low-privileged network attacker who wins a high-complexity attack, with a scope change that lets the compromise significantly impact products beyond the connector itself. Oracle rates this CVSS 3.1 8.5 with high confidentiality, integrity, and availability impact, and it is addressed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Elevation-of-scope compromise in Oracle Unified Directory (Fusion Middleware, OUD Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets an authenticated low-privileged attacker with LDAP network access read all OUD-accessible data and modify some of it, with a scope change that can significantly impact additional connected products. Oracle rates it CVSS 3.1 8.5, and the source intelligence tags it as an authentication-bypass-class issue. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity and scope change make it a meaningful patch priority for Oracle-integrated identity infrastructure.
Unauthorized critical-data access in Oracle E-Business Suite's Process Manufacturing Regulatory Management module (component: Internal Operations) allows a low-privileged, network-authenticated attacker to compromise the module over HTTP, with a scope change that may significantly impact additional Oracle products. Oracle rates it CVSS 3.1 8.5, reflecting high confidentiality impact plus limited integrity impact across a changed scope. There is no public exploit identified and it is not in CISA KEV, but Oracle self-reported it and shipped a fix in the July 2026 Critical Patch Update.
Data compromise and cross-product impact in Oracle E-Business Suite (Oracle Common Application Components, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical application data and cause a partial denial of service. Because the flaw carries a scope change (S:C), a successful attack can significantly affect additional Oracle products beyond the vulnerable component. Oracle rates it CVSS 3.1 8.4 but flags it as difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 (Core component) allows a high-privileged attacker positioned on the adjacent physical communication segment to compromise the server and, due to a scope change, significantly impact additional connected products. Successful exploitation yields complete loss of confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: Group Replication Plugin, where a local attacker holding only a logon to the host running the database can compromise the instance without any database credentials. The flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and carries a CVSS 3.1 base score of 8.4 with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Privilege-scoped compromise of Oracle Price Protection (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. Oracle rates it CVSS 3.1 8.4 with a scope change, meaning a successful attack can significantly impact products beyond Price Protection itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle-reported EBS flaws are historically high-value targets.
Privilege-escalation and data-compromise flaw in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) lets a low-privileged user who can log on to the host running ODI read, create, delete, or modify all ODI-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact other products beyond ODI itself, driving the CVSS 3.1 base score to 8.4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated local user.
Complete takeover of Oracle Applications Manager (a management console within Oracle E-Business Suite) is possible through the Command Line - RapidClone component in EBS versions 12.2.3 through 12.2.15. An attacker who already has logon access to the host infrastructure where the component runs can compromise it without any application-level authentication, gaining full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Sandbox confinement bypass in Canonical snapd (snap-confine) affects all supported Ubuntu LTS releases (16.04 through 26.04) because the default seccomp templates fail to block system calls that create or set set-user-ID flags on files. A process already running inside a strictly confined snap can compile or drop a binary, mark it setuid, and then execute it to escape confinement assumptions and perform privileged actions within the container namespace. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 8.4 (scope-changed) rating reflects a genuine confinement-escape primitive.
Privilege-scoped data compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged local user with logon access to the host read, create, modify, or delete all SDP-accessible data. Because the flaw carries a scope change (S:C), successful attacks can significantly impact adjacent Oracle products beyond SDP itself. There is no public exploit identified at time of analysis, and no EPSS or KEV signal is available in the provided data; Oracle disclosed it in the July 2026 Critical Patch Update.
Privilege escalation in FileGator (the open-source self-hosted PHP web file manager) lets an authenticated user who holds the 'chmod' permission set arbitrary Unix file modes via the '/chmoditems' API endpoint, ultimately elevating to root. The endpoint forwards attacker-supplied values straight to PHP's chmod() through octdec() with no validation or allow-listing, so a low-privileged operator can make sensitive binaries or files setuid/world-writable and gain full control of the host. No public exploit identified at time of analysis, and the issue is not in CISA KEV; EPSS was not provided.
XML external entity exposure in the Netty network framework affects the optional XmlDecoder handler in versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, where the underlying Aalto AsyncXMLInputFactory is instantiated without any security hardening. Any remote party able to push bytes into a channel pipeline that contains XmlDecoder can submit XML carrying a DOCTYPE/DTD declaration, and depending on Aalto async parser behavior DTD and entity processing remains active, creating a conditional path to reading local files or performing SSRF-style out-of-band requests. There is no public exploit identified at time of analysis, the issue is not on CISA KEV, and it is fixed in 4.1.136.Final and 4.2.16.Final.
Network-wide data destruction in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets a low-privilege subsite Administrator wipe all Ninja Forms data across an entire Multisite network. By abusing a site-scoped capability check paired with unsafe multisite migration defaults, an actor who reaches the nf_delete_all_data admin-ajax action with a valid per-site nonce triggers migration routines that iterate every blog and drop all nf3_* tables plus related options and transients - no super-admin or network-admin rights needed. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broad data compromise in Oracle Sales Offline (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data the application can access and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 8.3 (C:H/I:H/A:L) and describes it as easily exploitable, disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a strong patching priority.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when a remote, unauthenticated attacker lures a legitimate user into interacting with a malicious HTTP request, yielding high confidentiality, integrity, and availability impact plus a scope change to adjacent products. It affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.3. No public exploit identified at time of analysis and it is not listed in CISA KEV, though exploitation complexity is high.
Data compromise in Oracle Installed Base (Oracle E-Business Suite, Create Item Instance component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all Installed Base-accessible data and cause a partial denial of service. Rated CVSS 3.1 8.3 (High) with high confidentiality and integrity impact, it was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit was identified at time of analysis and it is not listed in CISA KEV, so exploitation is theoretical, but the low bar (any authenticated EBS account, no user interaction) makes it a strong patching priority.
Authenticated data tampering and denial of service in Oracle Enterprise Command Center Framework V16 (a Core component of Oracle E-Business Suite) lets a low-privileged attacker with network HTTP access create, delete or modify critical data, read a subset of accessible data, and force a complete, repeatable crash (full DoS). Oracle rates it CVSS 3.1 8.3 (C:L/I:H/A:H) and disclosed it in the Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege bar make it attractive to any actor already holding even limited EBS credentials.
Server-side request forgery in the mcp-webresearch MCP server (version 0.1.7, package @mzxrai/mcp-webresearch) lets remote attackers reach internal-only network services by feeding loopback, link-local, or cloud metadata addresses to the visit_page tool. Because the tool validates only the URL scheme and never filters private or reserved IP ranges, an attacker who influences the LLM-controlled URL - typically via prompt injection - can drive the server's Playwright browser to endpoints like 169.254.169.254 and exfiltrate credentials and other sensitive internal content back into the model context. No public exploit identified at time of analysis, though a detailed technical write-up exists and the issue is disclosed by VulnCheck; there is no CISA KEV listing.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible for an unauthenticated attacker positioned on the same physical/adjacent network segment as the host, per Oracle's July 2026 Critical Patch Update (CVE-2026-60471). The flaw carries a CVSS 3.1 base score of 8.3 and, notably, a scope change (S:C) meaning successful exploitation can significantly impact additional products beyond Imaging itself, resulting in takeover. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, but the confidentiality, integrity, and availability impact are all High.
Silent record suppression in AWS s2n-tls affects all TLS 1.3 connections (both client and server roles) because the AEAD implementation hardcodes the outer content_type (0x17) in the additional authenticated data instead of authenticating the actual wire byte, leaving that field outside the integrity tag. An active on-path attacker can selectively drop individual application_data records without either endpoint detecting tampering, causing HTTP request/response desynchronization or undetectable data loss on write-heavy workloads. Reported internally by Amazon (AMZN); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sandbox escape in Google Chrome prior to 150.0.7871.182 via an out-of-bounds write in the ANGLE graphics layer allows remote attackers to escape the browser sandbox after compromising the renderer process. No active exploitation or public exploit has been confirmed; EPSS likelihood is very low.
Unauthenticated data compromise in Oracle SOA Suite (12.2.1.4.0 and 14.1.2.0.0) lets a remote attacker reach the B2B Engine component over HTTP and read all data accessible to the product, plus induce a partial denial of service. The flaw requires no credentials and no user interaction (CVSS 8.2, C:H/A:L), placing it among the higher-severity items in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector warrants prompt patching.
Denial of service and data tampering in Oracle Coherence (Oracle Fusion Middleware, Core component) lets a remote unauthenticated attacker with TCP network access hang or repeatedly crash the in-memory data grid and perform unauthorized update, insert, or delete of some accessible data. Oracle rates it CVSS 3.1 8.2 and describes it as 'easily exploitable', reflecting no authentication and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privileged compromise of Oracle Quality, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), allows a high-privileged attacker with HTTP network access to read all Oracle Quality-accessible data, partially modify data, and cause partial denial of service. Because the flaw carries a scope change (S:C), successful attacks can significantly impact additional products beyond Oracle Quality itself. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 8.2 reflects meaningful confidentiality and cross-component risk.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise SCM Inventory 9.2 (Security component) lets a remote attacker reach the application over HTTP and read all data the module can access, plus perform limited unauthorized updates, inserts or deletes. Oracle rates it CVSS 3.1 8.2 and the intelligence tags it as an authentication-bypass class issue, meaning no valid credentials or user interaction are needed. No public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity, network-facing, no-privilege profile makes it a high-priority patch for Oracle ERP operators.
Unauthorized data access in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (French Public Sector Specific component) lets a remote, unauthenticated attacker read all HR-accessible data and modify a subset of it over HTTP. Oracle's July 2026 CPU rates it easily exploitable with high confidentiality and low integrity impact (CVSS 3.1 base 8.2), and third-party intel tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) lets remote attackers reach the application over HTTP and read all data the module can access, with limited unauthorized insert/update/delete on some data. Vendor and community tags flag this as an authentication bypass, aligning with the PR:N (no privileges) CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 8.2.
Unauthorized data access in Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated, network-based attacker read critical data and perform limited unauthorized modification over HTTP. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass, the flaw carries CVSS 8.2 (C:H/I:L) and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it easily exploitable with no privileges required.
Unauthorized data modification in Oracle PeopleSoft Enterprise SCM Purchasing 9.2 (Purchasing component) allows a remote, unauthenticated attacker with HTTP network access to create, delete, or modify critical Purchasing data and read a subset of accessible data. Oracle rates it CVSS 3.1 8.2 and describes it as easily exploitable with no privileges or user interaction, and its own tagging characterizes the flaw as an authentication bypass. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, so risk is currently driven by exposure rather than confirmed active exploitation.