Out-of-bounds read in Qt's QTextCodec::codecForName() causes incorrect text codec selection or a process crash (denial of service) when the function is supplied a non-NUL-terminated QByteArray constructed via QByteArray::fromRawData(). Affected components span Qt Core (qtbase) in Qt 4.x and 5.x, and the Qt5Compat module in Qt 6.0.0 onward. No public exploit has been identified and no CISA KEV listing exists; real-world risk is confined to applications whose codec-selection paths are reachable from attacker-controlled input and that specifically construct raw, non-NUL-terminated byte arrays before passing them to this API.
Unauthorized data exfiltration in Oracle HRMS (UK), a component of Oracle E-Business Suite, exposes complete HR records to low-privileged network attackers via a scope-changing vulnerability in the Internal Operations component. Versions 12.2.8 through 12.2.15 are affected, and successful exploitation can breach data beyond the immediate HRMS (UK) boundary, impacting additional E-Business Suite products. Tagged as an authentication bypass by EUVD intelligence, the attack requires HTTP network access and low privilege credentials but no user interaction, though high attack complexity (AC:H) limits opportunistic exploitation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Oracle Succession Planning within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity, network-exploitable vulnerability in the Succession Plan component that allows low-privileged attackers to read, modify, or partially disrupt succession planning data via HTTP. The CVSS 3.1 vector confirms low attack complexity with no user interaction required, making exploitation straightforward for any authenticated EBS user. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Oracle Price Protection (Internal Operations component) within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a medium-severity flaw allowing low-privileged, network-accessible attackers to partially compromise data confidentiality, integrity, and availability via HTTP. The vulnerability is easily exploitable with no attack complexity, requiring only a valid low-privileged account, enabling unauthorized read, write/delete operations on a subset of Price Protection data, and the ability to cause partial denial of service. No public exploit code or active exploitation has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Unauthorized data manipulation and partial denial of service affects the Calendar Synchronizations component of Oracle Common Applications Calendar in Oracle E-Business Suite versions 12.2.3 through 12.2.15. Low-privileged authenticated attackers with HTTP network access can read a subset of calendar data, insert or modify records, and cause partial service disruption - all without requiring user interaction. Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allowing low-privileged authenticated attackers to compromise data confidentiality, integrity, and availability via HTTP. Exploitation yields unauthorized read access to a subset of Bills of Material data, unauthorized insert, update, or delete capability, and the ability to cause a partial denial of service against the module. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's Critical Patch Update for July 2026.
Partial compromise of Oracle Advanced Benefits (Self Service Benefits component) is achievable by any low-privileged, network-adjacent attacker over HTTP, affecting all E-Business Suite deployments on versions 12.2.4 through 12.2.15. Successful exploitation yields unauthorized read access to a subset of benefits data, unauthorized write/insert/delete capability against accessible records, and the ability to cause partial denial of service within the affected component. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog, though the low complexity and minimal privilege threshold make it accessible to a broad pool of internal threat actors.
Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) exposes a network-exploitable flaw in its Outlook Sync Win 32 component that allows low-privileged authenticated users to perform unauthorized data reads, writes, and cause a partial denial of service via HTTP. Oracle classified this as easily exploitable, with low attack complexity and no user interaction required beyond holding a valid low-level account. No public exploit identified at time of analysis and it does not appear in the CISA KEV catalog, but the low barrier to exploitation makes it a credible insider or compromised-credential threat for affected EBS deployments.
Oracle Proposals (component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated remote attackers over HTTP, enabling unauthorized read access to a subset of data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the Proposals component. Oracle disclosed this vulnerability in its July 2026 Critical Patch Update (CPU). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is compromised by a low-privileged, network-accessible attacker via HTTP, yielding partial confidentiality, integrity, and availability impacts. Exploitation requires no user interaction, making it straightforward for any authenticated EBS user to abuse this flaw. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Oracle Marketing's Audience component, within Oracle E-Business Suite versions 12.2.3 through 12.2.15, permits low-privileged authenticated network attackers to exploit the application over HTTP with low complexity. Successful exploitation yields unauthorized read access to a subset of marketing data, unauthorized insert/update/delete capability against that data, and the ability to cause a partial denial of service within the Oracle Marketing module. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a flaw in its Role Based Security component that allows a low-privileged, network-authenticated attacker to exceed their authorized data access via HTTP. Successful exploitation yields unauthorized read access to a subset of product catalog data, unauthorized insert, update, or delete operations on accessible records, and the ability to cause partial denial of service within the Product Hub module. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Oracle Product Hub's Item Catalog component in E-Business Suite versions 12.2.3 through 12.2.15 exposes an easily exploitable flaw allowing low-privileged, authenticated HTTP network attackers to compromise item master data. Successful exploitation yields unauthorized read access to a subset of Product Hub data, unauthorized data modification or deletion, and partial denial of service against the Product Hub component. No public exploit identified at time of analysis, and Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update.
Oracle Product Workbench's WebUI component within E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated attackers reachable over HTTP to perform unauthorized data reads, inserts, updates, and deletions against accessible product data, and to cause partial denial of service. Oracle's CPU July 2026 advisory characterizes the vulnerability as 'easily exploitable,' indicating a low-complexity attack path once valid low-level credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis, placing current exploitation status as unconfirmed.
Oracle Advanced Inbound Telephony (versions 12.2.3 through 12.2.15) within Oracle E-Business Suite exposes a medium-severity network-exploitable flaw in its Servers component that allows low-privileged authenticated attackers to perform unauthorized data reads, data manipulation, and partial denial of service via HTTP. Disclosed as part of Oracle's Critical Patch Update for July 2026 and tracked under ENISA EUVD-2026-47445, the vulnerability carries a CVSS 3.1 base score of 6.3, reflecting its low complexity and absence of required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad affected version range make it a meaningful risk for organizations running unpatched Oracle E-Business Suite deployments.
Oracle Payroll within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 is exploitable by low-privileged authenticated network attackers via HTTP, enabling unauthorized read, write, and partial denial-of-service against payroll data. Oracle's own advisory classifies this as 'easily exploitable,' indicating low attack complexity for any valid EBS user with HTTP reachability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, placing this as a moderate real-world priority requiring prompt patching for exposed EBS deployments.
Oracle Concurrent Processing within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a medium-severity flaw in its BI Publisher Integration component that allows a low-privileged, authenticated network attacker to compromise data integrity, read restricted data, and cause partial denial of service via HTTP. The vulnerability is described by Oracle as 'easily exploitable,' lowering the bar for abuse by any user holding a valid account. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, though its low attack complexity and no-UI-interaction requirements make it operationally straightforward once credentials are obtained.
Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 expose the Collaboration History component to unauthorized data access and service degradation by any authenticated network user over HTTP. Low-privileged attackers can read a subset of accessible records and perform unauthorized inserts, updates, and deletes, as well as cause a partial denial of service. No public exploit code and no CISA KEV listing exist at time of analysis, but Oracle's own advisory classifies this as 'Easily exploitable,' indicating minimal preconditions beyond valid credentials.
Oracle Application Object Library (AOL), the Core component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exploitable over HTTP by low-privileged authenticated attackers with network access, resulting in partial unauthorized read access to AOL data, unauthorized data modification or insertion, and partial denial of service against AOL services. Oracle's July 2026 Critical Patch Update (CPU) addresses this vulnerability and classifies it as 'easily exploitable,' indicating limited technical barriers to exploitation. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the broad affected version range and low exploitation complexity elevate remediation priority for internet-facing EBS deployments.
Oracle E-Business Suite's Scheduler component (Rules UI) in versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to read restricted scheduling data, manipulate scheduling rules via unauthorized insert, update, or delete operations, and cause partial denial of service - all via HTTP without user interaction. Disclosed as part of Oracle's July 2026 Critical Patch Update, this vulnerability carries a CVSS 6.3 medium rating with no public exploit or CISA KEV listing identified at time of analysis.
Oracle Project Foundation's Project Definition component in E-Business Suite versions 12.2.3 through 12.2.15 allows any low-privileged authenticated user to exploit HTTP-accessible endpoints, resulting in unauthorized read, insert, update, or delete of project data and partial denial of service. Disclosed in Oracle's Critical Patch Update for July 2026 and described by Oracle as 'easily exploitable,' the flaw's low attack complexity and absence of required user interaction broaden the practical attacker population to any valid EBS credential holder. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS signal is available from the provided intelligence.
Oracle Workflow's Notification Mailer component within E-Business Suite 12.2.3-12.2.15 is exploitable by network-authenticated low-privileged users to partially read, modify, and disrupt workflow data over HTTP without user interaction. The CVSS 3.1 score of 6.3 (Medium) reflects constrained but multi-dimensional CIA impact (C:L/I:L/A:L) with low attack complexity, making exploitation straightforward for any valid EBS account holder. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; remediation is available through the Oracle Critical Patch Update for July 2026.
Oracle Content Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite expose a medium-severity flaw in the Cover Letter component, exploitable by any low-privileged authenticated user over HTTP without user interaction. Successful exploitation allows unauthorized read access to a subset of Content Manager data, unauthorized insert/update/delete of accessible records, and partial denial of service against the component. No public exploit code and no CISA KEV listing have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.
Partial confidentiality, integrity, and availability compromise in Oracle Partner Management's Partner Dashboard component (E-Business Suite 12.2.3-12.2.15) is reachable over HTTPS by any low-privileged account holder without user interaction. Successful exploitation allows unauthorized read access to a subset of partner data, unauthorized modification or insertion of records, and partial denial of service against the affected component. No public exploit code or CISA KEV listing exists at time of analysis; the July 2026 Oracle Critical Patch Update addresses the issue.
Network-exploitable integrity, confidentiality, and availability compromise in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3 through 12.2.15) allows low-privileged authenticated attackers over HTTP to read, modify, or partially disrupt accessible data within the Web Service Provider component. Oracle rates this CVSS 6.3 Medium, with all three security pillars impacted at a low level and no scope change beyond the affected component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a credible threat for any internet- or intranet-reachable EBS deployment running the affected version range.
Partial data compromise and service disruption in Oracle Advanced Inbound Telephony 12.2.3-12.2.15 (SDK client integration component) is exploitable by a low-privileged attacker over HTTP without requiring user interaction. Successful exploitation allows unauthorized read access to a subset of telephony data, unauthorized insert, update, or delete operations on accessible data, and partial denial of service against the affected module. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS data was not available in the provided intelligence.
Prototype Pollution in the mongo-object npm package (versions before 3.0.3) allows network-reachable attackers to corrupt the JavaScript Object.prototype by supplying crafted property paths containing special keys such as __proto__, constructor, or prototype to the expandKey() function in util.ts. No authentication or user interaction is required, though high attack complexity reflects the need for attacker-controlled input to reach the vulnerable function. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS data is not provided, and the CVSS base score of 4.0 (Medium) reflects a narrowly scoped integrity impact without confidentiality or availability consequences.
Unauthorized data access and partial denial of service in Oracle Advanced Benefits (E-Business Suite Self Service Benefits component) is achievable by low-privileged, network-authenticated attackers over HTTP. Versions 12.2.3 through 12.2.15 are confirmed affected, spanning a broad range of Oracle EBS deployments. Oracle classifies this as 'easily exploitable' in the July 2026 CPU; no public exploit identified at time of analysis and not listed in CISA KEV, but the low attack complexity and no user interaction requirement elevate realistic risk for organizations with internal threat actors or compromised credentials.
Oracle HCM Configuration Workbench versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes its Install component to network-accessible exploitation by any low-privileged authenticated user over HTTP. Successful exploitation yields unauthorized read access to a subset of HCM data, unauthorized insert/update/delete capability against accessible data, and the ability to cause partial denial of service against the component. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability was disclosed as part of Oracle's Critical Patch Update for July 2026.
Import and Export component exploitation in Oracle Learning Management (Oracle E-Business Suite 12.2.3-12.2.15) allows a network-authenticated low-privileged user to partially read, manipulate, or delete LMS data and degrade service availability over HTTP. The flaw is rated CVSS 6.3 with low attack complexity and no user interaction required beyond a valid account. No public exploit code or CISA KEV listing has been identified at time of analysis, positioning this as a credible internal-threat-actor or compromised-credential risk rather than an opportunistic internet-facing attack.
Oracle Quality within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes partial confidentiality, integrity, and availability compromise through its Quality Workbench HTML system component. A low-privileged authenticated attacker with HTTP network access can perform unauthorized read, write, and denial-of-service operations against Quality module data. No public exploit code or active exploitation has been identified at time of analysis; this vulnerability was disclosed by Oracle via the July 2026 Critical Patch Update.
Oracle HRMS (US) US Payroll - General component in Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes payroll data and service availability to low-privileged authenticated network attackers over HTTP. Successful exploitation yields partial unauthorized read of payroll records, unauthorized insert, update, or delete of accessible payroll data, and partial denial of service - impacts that are especially sensitive given the nature of US payroll information. Disclosed as part of Oracle's July 2026 Critical Patch Update, no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Oracle Lease and Finance Management within Oracle E-Business Suite (versions 12.2.3-12.2.15) exposes its Lease Authoring component to exploitation by low-privileged, network-accessible attackers over HTTP, resulting in partial confidentiality loss, unauthorized data manipulation, and a partial denial of service. The vulnerability is classified as easily exploitable with no user interaction required, making it accessible to any authenticated low-privilege user who can reach the application over the network. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Partial data compromise and denial of service in Oracle HRMS (UK) versions 12.2.3 through 12.2.15 allows low-privileged, network-authenticated attackers to perform unauthorized read, write, and partial disruption of HR data via HTTP. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable,' lowering the practical barrier for authenticated insiders or compromised accounts. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Partial data compromise and denial of service in Oracle Supply Chain Globalization (Oracle E-Business Suite) allows low-privileged authenticated attackers over HTTP to perform unauthorized read, write, and partial availability impacts against the Copy Inventory Organization component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the category of a credible but not actively weaponized medium-severity vulnerability.
Oracle Site Hub's Site Hierarchy Flows component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a medium-severity flaw accessible to low-privileged authenticated users over HTTP with no user interaction required. Successful exploitation yields partial unauthorized read access to Site Hub data, unauthorized insert, update, or delete capability against accessible data, and the ability to induce a partial denial of service within the application. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis; this vulnerability was disclosed as part of Oracle's July 2026 Critical Patch Update.
Out-of-bounds read in Data::RoaringBitmap::Shared before version 0.02 for Perl allows a local peer with write access to the shared backing file to redirect memory reads to arbitrary locations. The module's attach-time header validator (rb_validate_header) checks structural metadata but skips bucket content validation, so rb_contains_locked blindly trusts file-stored container offsets and cardinalities. On the next membership query, the process dereferences a fully attacker-controlled pointer and iterates over an attacker-controlled count, exposing adjacent heap or stack memory and potentially crashing the querying process. No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low real-world exploitation activity.
Server-Side Request Forgery in Gitea's `restore-repo` CLI command allows an attacker who can supply a malicious dump archive to a Gitea administrator to force the server to issue `git fetch` against arbitrary attacker-controlled or internal URLs, including cloud metadata endpoints and local filesystem paths via `file://`. The root cause is a Go language logic defect: `CheckAndEnsureSafePR` is invoked with an empty `commonCloneBaseURL` string, causing `strings.HasPrefix(anything, "")` to always return `true`, which silently disables the URL validation guard for `Head.CloneURL` in the restore path only. A detailed PoC is publicly documented in the GHSA advisory; no CISA KEV listing is present, indicating active exploitation is unconfirmed at time of analysis. Fix is available in Gitea v1.27.0.
Full takeover of Oracle Autonomous Health Framework is achievable by a highly privileged local attacker under difficult exploitation conditions in versions 26.0.0 through 26.2.0, specifically within the Developer triaging platform component. Successful exploitation requires both high infrastructure privileges and active human interaction from a separate user, making opportunistic attacks unlikely. No public exploit code or CISA KEV listing has been identified; this vulnerability appears to be a low-frequency, targeted risk rather than a widespread exploitation concern.
Oracle Cost Management versions 12.2.3 through 12.2.15 (Cost Planning component) exposes a network-exploitable flaw enabling a high-privileged attacker to compromise full data confidentiality and integrity within the module, plus cause partial denial of service. Oracle's own CPU July 2026 advisory classifies this as difficult to exploit due to high attack complexity and elevated privilege prerequisites, yielding a medium CVSS 3.1 score of 6.2 despite high C/I impact ratings. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in SolarWinds Serv-U enables session hijacking and information disclosure from administrator accounts via malicious script persistence in the application. The vulnerability requires a high-privileged attacker to inject the payload, which then executes in the browser context of any administrator who views the poisoned content - a classic privilege-boundary-crossing XSS pattern confirmed by the CVSS scope-change flag. No public exploit code has been identified at time of analysis, and a vendor fix appears in Serv-U 2026.3 based on release note references.
World-readable mmap backing files and absent O_NOFOLLOW protection in Data::Buffer::Shared for Perl (versions before 0.05) expose inter-process communication payloads to any local user on the affected host. The module's buf_generic.h creates shared memory segments with mode 0666, resulting in 0644 files under the default umask of 022, and omits O_NOFOLLOW during segment attachment, enabling symlink-based file-redirect attacks against /tmp or /dev/shm paths. No exploit code is publicly available and no active exploitation has been confirmed; EPSS at 0.16% (6th percentile) reflects the niche deployment footprint, though any local user on a system running an affected Perl application can trivially read IPC payloads without elevated privileges.
Local denial-of-service in Oracle MySQL Server and MySQL Cluster allows an unauthenticated attacker with OS-level logon access to the host infrastructure to crash or hang the database service via a flaw in the Replication component. Affected versions span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Oracle classifies this as easily exploitable; no public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires physical or logical host-level access rather than remote network reachability.
Denial-of-service via the Content Acquisition System component in Oracle Commerce Guided Search / Experience Manager 11.4.0 allows any local user already logged onto the host infrastructure to crash or hang the application without requiring elevated OS privileges. Disclosed in Oracle's July 2026 Critical Patch Update, the CVSS 3.1 score of 6.2 (Medium) reflects the local-only attack vector, which substantially constrains exposure to insider threats or attackers who have already achieved OS-level foothold. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis.
Cross-site scripting or request-forgery class vulnerability in Oracle Time and Labor (E-Business Suite component: Internal Operations) enables unauthenticated remote attackers to compromise confidentiality and integrity via HTTP when a victim user interacts with attacker-controlled content, with scope change indicating impact extends beyond the vulnerable component to additional E-Business Suite products. Affected deployments span versions 12.2.3 through 12.2.15. The Oracle July 2026 CPU addresses this; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data manipulation and read access in Oracle Contracts Integration (E-Business Suite 12.2.3-12.2.15) is achievable by unauthenticated network attackers over HTTP when a victim user interacts with a crafted request. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) combined with the reported 'Authentication Bypass' tag indicates a web-injection pattern - most likely reflected or stored Cross-Site Scripting - within the Internal Operations component, where a successful attack can pivot beyond the directly vulnerable module to affect adjacent Oracle EBS components due to scope change. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Cross-site scripting or client-side injection in Oracle Contracts Integration (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers to compromise victim sessions via crafted HTTP requests requiring user interaction. The CVSS scope-change indicator (S:C) and UI:R flag confirm the attack pivots through a victim's browser to affect a secondary security context, resulting in unauthorized read access to a subset of data and unauthorized write/insert/delete to accessible Contracts Integration data. No public exploit code has been identified at time of analysis, and a patch is available through Oracle's Critical Patch Update for July 2026.
The Search component of Oracle Knowledge Management in E-Business Suite versions 12.2.5 through 12.2.15 allows unauthenticated network attackers to compromise data confidentiality and integrity when a victim user interacts with a crafted HTTP request, with successful exploitation producing a scope change that can impact additional E-Business Suite products. Disclosed via Oracle's July 2026 Critical Patch Update, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) scores 6.1 and is consistent with a reflected injection class - likely Cross-Site Scripting - given the combination of no-privilege network access, required human interaction, and cross-product scope change. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site injection in Oracle iStore's Shopping Cart component (E-Business Suite versions 12.2.3-12.2.15) enables unauthenticated remote attackers to read a subset of iStore-accessible data and perform unauthorized data modifications, with a scope change indicating impact can extend to adjacent Oracle E-Business Suite modules. The attack requires victim interaction via HTTP but no credentials, and Oracle has published a fix in the July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the vendor-assigned tag of 'Authentication Bypass' suggests the client-side injection may circumvent session-level controls beyond what the CVSS score alone implies.
Cross-site scripting or client-side injection in Oracle E-Business Intelligence 12.2.3 through 12.2.15 enables unauthenticated remote attackers to read a subset of accessible data and perform unauthorized data modifications when a victim user interacts with a crafted HTTP request. The scope change (S:C in CVSS) indicates successful exploitation extends impact beyond the vulnerable component - characteristic of a browser-context attack such as reflected XSS through the Internal Operations component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the tagging as 'Authentication Bypass' alongside PR:N merits close attention in enterprise deployments.