Webhook authorization headers in Gitea are decrypted and returned as plaintext in API responses, exposing Bearer tokens, Basic auth credentials, and API keys to any repository admin who queries the webhook listing endpoints. All Gitea installations running versions prior to 1.27.0 are affected, confirmed by GitHub Advisory GHSA-3r5c-2xxx-h872 and verified against commit 19f0169. Although these secrets are encrypted at rest using the server's SecretKey, the ToHook() function strips that protection before serializing the API response - effectively converting a write-only secret into a readable credential. No public exploit has been identified and this vulnerability is not listed in CISA KEV, but the business impact of leaking third-party API keys in multi-admin environments exceeds what the CVSS 2.7 Low score implies.
Authorization bypass in ZS-Admin's multi-tenant API layer allows authenticated remote attackers to read department listing data belonging to other tenants by supplying an arbitrary value in the X-Tenant-Id HTTP header against the /api/system/sys/dept/page endpoint. The root cause is the getTenantId function of the MyBatis-Plus Tenant Plugin trusting a client-controlled header rather than deriving tenant scope from the authenticated session server-side. A public proof-of-concept is available via GitHub issue #5; no vendor patch or acknowledgment has been issued and the project has not responded to the disclosure.
Unrestricted file upload in ZS-Admin (zsadmin2025/zs-admin-java) exposes the /api/system/file/upload API endpoint to malicious file submission by authenticated low-privilege users. The SysFileController component fails to validate or restrict file types, allowing an attacker to upload arbitrary content to the server. A public proof-of-concept exists via the project's GitHub issue tracker; the vendor has not yet responded or issued a patch as of the time of disclosure.
SQL injection in itsourcecode Hospital Management System 1.0 allows remote authenticated attackers to manipulate database queries via the `editid` parameter in `/prescriptionorder.php`. The CVSS 4.0 vector (PR:L) confirms low-privilege authenticated access is required, limiting opportunistic exploitation but not targeted abuse by authorized users or compromised accounts. A publicly available proof-of-concept exploit exists on GitHub, lowering the barrier for exploitation. No patch has been identified; no public exploit identified at time of analysis in CISA KEV.
SQL injection in ZS-Admin (zsadmin2025) exposes authenticated remote attackers to database manipulation via the orderField parameter in the department pagination API. The vulnerable sorting functions OrderItem.asc and OrderItem.desc in SysDeptController accept unsanitized input and construct ORDER BY clauses through string concatenation, enabling injection against all instances up to commit b52e14536d59fda11e56e2536a1c32e82a38cead. A public exploit has been disclosed through the project's own GitHub issue tracker, and no vendor response or patch has been issued at time of analysis.
Command injection in D-Link's remote backup CGI handler exposes approximately 20 NAS and NVR device models - including DNS-320, DNS-325, DNS-1200-05, and DNS-1550-04 - to remote OS command execution by authenticated low-privilege users. The vulnerable parameter is the 'ip' argument passed to the cgi_check_rsync_rw function in /cgi-bin/remote_backup.cgi, which fails to sanitize shell metacharacters before constructing system commands (CWE-77). No public exploit identified at time of analysis as confirmed CISA KEV listing, but a proof-of-concept has been made public, and most affected devices are likely end-of-life with no patch forthcoming.
Shell metacharacter injection in libssh's ProxyCommand handling allows a crafted SSH username to break out of the intended command string when the %r token is expanded. Affecting libssh deployments that use ProxyCommand with %r substitution, a low-privileged local attacker who controls the username passed to the connection can cause the shell executing the ProxyCommand to expand environment variables or alter its behavior, leaking sensitive environment data. No public exploit is identified and this is not listed in CISA KEV; CVSS rates this Low (3.9), consistent with the constrained local attack surface and limited impact.
Oracle HRMS (Norway) Payroll component within E-Business Suite versions 12.2.3 through 12.2.15 exposes limited confidentiality and integrity risks to high-privileged authenticated network attackers over HTTP. A successfully exploited vulnerability enables unauthorized read access to a subset of Norway Payroll data and unauthorized update, insert, or delete operations on accessible records within that module. No public exploit code has been identified at time of analysis, CISA KEV listing is absent, and the CVSS 3.1 base score of 3.8 (Low) reflects the constrained scope and high privilege bar required.
Information disclosure in the Perl Data::Deque::Shared module before version 0.06 exposes inter-process communication queue contents to any local user due to a world-readable mmap backing file and unsafe open() flags. The shared segment is created in /tmp or /dev/shm with mode 0644 (after umask 022), and the absence of O_NOFOLLOW and O_EXCL permits symlink-following and pre-creation race attacks against the backing file path. Any local account on a multi-user host can passively read sensitive IPC payloads, or actively redirect the segment open via a pre-planted symlink. No active exploitation has been identified - EPSS is 0.16% (6th percentile) and the vulnerability is not in CISA KEV.
World-readable IPC segment exposure in Data::SpatialHash::Shared (Perl) before version 0.02 allows any local user on a multi-user system to read the contents of shared memory payloads written by other processes using the module. The root cause is a combination of overly permissive file creation mode (0666, yielding 0644 under default umask) and the absence of O_EXCL and O_NOFOLLOW flags when opening the mmap backing file in sphash.h, enabling both passive eavesdropping and pre-creation file/symlink attacks. No active exploitation has been identified (EPSS: 0.16%, 6th percentile; not in CISA KEV), and the fix is available in version 0.02.
Insecure file creation in Data::Intern::Shared for Perl (all versions before 0.02) exposes shared memory IPC payloads to any local user on the same host. The module's intern.h opens its mmap backing file with mode 0666 - effective 0644 under the standard umask - making the segment world-readable, while missing O_EXCL and O_NOFOLLOW flags independently enable a pre-creation file-race and a symlink-redirect attack. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), consistent with the niche deployment footprint of this CPAN IPC library.
World-readable mmap backing file creation and missing symlink/exclusivity guards in Data::RingBuffer::Shared before version 0.04 expose inter-process IPC payloads to any local user on the host. The module creates its shared segment in ring.h with mode 0666 (effective 0644 under default umask 022), making contents in /tmp or /dev/shm readable by all local users; omission of O_EXCL and O_NOFOLLOW further enables pre-creation race and symlink-redirect attacks. No public exploit has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects low exploitation probability commensurate with the module's niche deployment footprint.
World-readable mmap backing file creation in Data::HashMap::Shared (Perl CPAN module) versions before 0.14 exposes inter-process communication payloads to any local user co-resident on the same system. The module's shm_generic.h opens its shared memory segment with mode 0666 (resulting in 0644 under default umask 022) in world-accessible directories such as /tmp or /dev/shm, while omitting both the O_EXCL and O_NOFOLLOW flags - enabling a local attacker to either read IPC payloads directly from the world-readable file or redirect the open via a pre-planted symlink. No public exploit has been identified (EPSS 0.16%, 6th percentile) and there is no CISA KEV listing, but the primary information-disclosure vector requires no race condition and is trivially exploitable by any unprivileged local user on a multi-tenant system.
World-readable mmap backing file creation in Data::RadixTree::Shared before 0.02 exposes inter-process communication payloads to any authenticated local user on the system. The Perl module's radix.h opens the shared segment file with mode 0666 (resolving to 0644 under default umask), while omitting both O_EXCL and O_NOFOLLOW, enabling two distinct local attack paths: passive reading of IPC segment contents from /tmp or /dev/shm, and an active file-planting or symlink-redirection attack exploiting the missing exclusive-creation guard. No public exploit is identified at time of analysis; EPSS at 0.16% (6th percentile) and absence from CISA KEV indicate no current active exploitation.
World-readable mmap backing file creation in Data::SortedSet::Shared before 0.03 exposes IPC payloads to any local user and enables symlink or pre-creation race attacks on the same host. The module's sortedset.h opens the shared segment file with mode 0666 (yielding 0644 after umask), no O_EXCL, and no O_NOFOLLOW, meaning a local attacker can passively read any data written to the segment or actively redirect the open() to an attacker-controlled file. No public exploit has been identified at time of analysis; EPSS is 0.16% at the 6th percentile, consistent with the niche footprint of this Perl CPAN module.
World-readable mmap backing files in Data::ReqRep::Shared (Perl) versions before 0.05 expose IPC request-reply payloads to any local user on multiuser Unix/Linux systems. The module's reqrep.h creates shared memory segments in directories like /tmp or /dev/shm with open() using O_RDWR|O_CREAT and mode 0666, yielding 0644 under a default umask of 022 - readable by all local users. Two additional unsafe-open defects compound the issue: the absence of O_NOFOLLOW enables symlink redirection, and the absence of O_EXCL allows silent reuse of a pre-planted file. No public exploit code has been identified and EPSS is 0.16% (6th percentile), indicating no current broad exploitation interest.
Insecure shared-memory file creation in the Perl module Data::PubSub::Shared before version 0.07 exposes inter-process communication payloads to any local user on the system. The backing mmap file is created with mode 0666 (effective 0644 under umask 022), is placed in world-accessible directories such as /tmp or /dev/shm, and is opened without O_EXCL or O_NOFOLLOW, enabling both passive eavesdropping on IPC traffic and active pre-creation or symlink-redirect attacks. No public exploit code has been identified at time of analysis, and EPSS sits at the 6th percentile, indicating low current exploitation interest; however, the world-readable condition requires no race-winning and is trivially exploitable by any local authenticated user.
Local information disclosure in Oracle TimesTen In-Memory Database 26.1.1.1.0 (Kubernetes Operator component) permits a low-privileged local attacker to read a subset of database-accessible data. The CVSS scope change (S:C) indicates exploitation can extend impact beyond the vulnerable component itself, potentially affecting other workloads or namespaces co-located in the same Kubernetes cluster. No public exploit code exists and no active exploitation has been confirmed at time of analysis; overall real-world risk is constrained by the requirement for local infrastructure access.
Partial denial of service in JD Edwards EnterpriseOne Tools 9.2.26.3 is achievable by an unauthenticated remote attacker via the JDENET protocol, specifically through the Interoperability Security component. The vulnerability carries a low CVSS base score of 3.7 driven by high attack complexity and limited availability-only impact, with no confidentiality or integrity consequences. No public exploit code or active exploitation has been identified at time of analysis, placing this at low operational priority for most organizations.
Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized read access to a subset of student records data is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component over HTTP. An unauthenticated network attacker exploiting an authentication bypass condition (tagged explicitly by the reporter) can retrieve confidential academic data without credentials, though the high attack complexity constrains opportunistic mass exploitation. No public exploit code or active exploitation has been identified; however, even partial disclosure of student records carries regulatory significance under FERPA regardless of the low CVSS score of 3.7.
Unauthorized read access to Oracle Time and Labor data is achievable by unauthenticated remote attackers targeting the Internal Operations component via HTTP, affecting E-Business Suite versions 12.2.3 through 12.2.15. Tagged as an Authentication Bypass, the flaw allows network-based attackers to circumvent access controls without credentials, though the high attack complexity (AC:H) constrains reliable exploitation. Impact is confined to partial confidentiality loss - no integrity or availability impact - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized read access to Oracle iSupplier Portal (E-Business Suite versions 12.2.3-12.2.15) is possible for unauthenticated network attackers targeting the Internal Operations component over HTTP. The Authentication Bypass tag indicates the root cause involves inadequate access controls on internal HTTP endpoints, though exploitation is constrained by high attack complexity (AC:H), meaning specific conditions must be met. Impact is confined to partial confidentiality loss - no integrity or availability impact - with no public exploit code or active exploitation confirmed at time of analysis.
Unauthorized data read in Oracle JDeveloper's Data Visualization Tools component exposes a subset of accessible application data to remote unauthenticated attackers via HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, with Oracle tagging this as an authentication bypass class issue. Despite the network-accessible attack vector with no privilege requirement, the high attack complexity (AC:H) and limited confidentiality impact (C:L) anchor this at CVSS 3.7 (Low). No public exploit code exists and it is not listed in the CISA KEV catalog.
Unauthorized read access to a subset of Oracle JDeveloper data is possible via an unauthenticated HTTP-based attack against the ADF Faces component in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and while exploitation requires high attack complexity, no authentication is needed. No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and the CVSS 3.1 score of 3.7 (Low) reflects the limited confidentiality impact and elevated exploitation difficulty.
Integrity compromise in Oracle Java SE's ImageIO component allows unauthenticated remote attackers to perform unauthorized data modification against a broad range of Java SE and GraalVM versions. Exploitation requires high attack complexity, limiting opportunistic mass exploitation, but the scope spans ten distinct supported releases across Java SE 8 through 26 and both GraalVM product lines. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the low CVSS score of 3.7 belies a moderately wide attack surface given Java's deployment footprint.
Unauthorized data manipulation via authentication bypass in Oracle Siebel CRM Integration's Siebel Server Sync for Exchange component allows unauthenticated remote attackers to insert, update, or delete a subset of CRM-accessible data over HTTP. All versions from 17.0 through 26.5 are affected, with exploitation constrained by high attack complexity that substantially reduces real-world risk. No public exploit code or active exploitation has been identified at time of analysis, consistent with the low CVSS score of 3.7 reflecting limited, integrity-only impact.
HCL IntelliOps Event Management (IEM) fails to enforce HTTP Strict Transport Security (HSTS), enabling network-positioned attackers to perform SSL stripping and intercept communications that should be protected by TLS. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates unauthenticated network exploitation but at high attack complexity, meaning the attacker must occupy a man-in-the-middle position on the network path. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing realistic risk in the low-to-moderate range confined to adversarial network environments.
Authentication bypass in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 (Installation Security component) permits an unauthenticated attacker on the same physical network segment to partially read and modify data accessible to the application. Exploitation is constrained by high attack complexity and a mandatory user-interaction requirement, making opportunistic attacks highly impractical. No public exploit code exists and the vulnerability is not listed in CISA KEV; CVSS 3.7 (Low) accurately reflects the limited real-world threat.
Oracle Work in Process within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes low-privileged local attackers to unauthorized partial data disclosure and partial denial-of-service conditions via the Internal Operations component. Exploitation demands an existing OS-level logon to the host infrastructure and high attack complexity, making reliable exploitation difficult and opportunistic mass exploitation implausible. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, consistent with the vendor-assigned CVSS 3.1 score of 3.6 (Low).
Local privilege abuse in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 allows a low-privileged attacker with infrastructure logon access to perform unauthorized data modifications and induce a partial denial of service against the Enterprise Infrastructure Security component. The attack complexity is rated High, meaning specific conditions beyond the attacker's direct control must be met. No public exploit code exists and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, placing it in a low operational risk tier despite the ERP-critical nature of the platform.
Oracle Workflow's Notification Mailer component within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) contains a locally-exploitable flaw that enables a low-privileged attacker with infrastructure logon access to partially corrupt workflow data and degrade service availability. The CVSS score of 3.6 reflects the real-world difficulty: local access is mandatory, attack complexity is rated High, and no confidentiality exposure exists. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, making this a low-priority operational finding relative to typical enterprise vulnerability backlogs.
Oracle Project Manufacturing V16's PJM Command Center component exposes a low-severity local vulnerability requiring infrastructure-level access and high attack complexity. A low-privileged attacker with logon access to the host infrastructure can, under difficult exploitation conditions, perform unauthorized data modification or deletion against accessible Project Manufacturing records and induce a partial denial of service against the component. No public exploit code exists and this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog, placing practical risk well below the already-low CVSS score of 3.6 suggests.
Integrity compromise in Oracle Enterprise Manager Base Platform 24.1 Security Framework allows a low-privileged, network-authenticated attacker to perform unauthorized insert, update, or delete operations on accessible platform data via HTTPS, contingent on victim interaction. No public exploit code or CISA KEV listing exists at time of analysis. Despite the 'Authentication Bypass' tag in source intelligence, the CVSS vector (PR:L, UI:R) indicates partial privilege circumvention rather than full authentication elimination, and the overall CVSS 3.5 Low score reflects constrained, integrity-only impact.
Proxy credential leakage in libsoup's SoupAuthManager causes cached Proxy-Authorization headers to be forwarded to subsequently configured proxy endpoints without verifying the new proxy authority matches the original. Applications built on libsoup - including many GNOME-based applications on Red Hat Enterprise Linux 10 - are affected whenever the system proxy configuration changes mid-session via manual settings or WPAD. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 3.4 reflects low confidentiality impact constrained by the circumstantial trigger condition.
Oracle Order Entry in E-Business Suite versions 12.2.3 through 12.2.15 exposes a low-severity local privilege vulnerability in its Internal Operations component, allowing a high-privileged local attacker to perform unauthorized data manipulation and cause partial service disruption. The attack requires physical or logical access to the infrastructure hosting the application and an already-elevated account, significantly constraining real-world exploitability. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at the time of analysis.
PeopleSoft Enterprise FIN Engineering Argentina version 9.1 exposes a secondary authorization flaw in its Engineering component that enables a network-reachable high-privileged attacker to perform unauthorized read and limited write operations against accessible financial data via HTTP. The Oracle-provided CVSS 3.1 score of 3.3 (Low) reflects high attack complexity and high privilege prerequisites, substantially containing real-world risk. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the reporter-supplied 'Authentication Bypass' tag conflicts with the PR:H CVSS metric and warrants vendor clarification.
Insecure file creation in the Perl CPAN module Data::Graph::Shared before version 0.04 exposes inter-process communication (IPC) payloads to any local user on the system. The mmap backing file used for shared memory segments is created with permissions 0666 (effectively 0644 after umask), making stored IPC data world-readable in shared directories such as /tmp or /dev/shm. Two additional missing flags - O_EXCL and O_NOFOLLOW - allow a local attacker to either win a pre-creation race to substitute their own file or plant a symlink to redirect the open call. No public exploit code has been identified and EPSS is 0.16% (6th percentile), consistent with limited real-world exploitation interest.
World-readable shared memory segments in Data::NDArray::Shared before 0.02 expose IPC payloads to any local user on the system. The module's ndarray.h creates mmap backing files in shared directories such as /tmp or /dev/shm with effective permissions 0644 (world-readable under umask 022) and omits both O_EXCL and O_NOFOLLOW from the open call, enabling passive eavesdropping on shared memory contents and a pre-creation race or symlink-redirect attack by any unprivileged local account. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low exploitation probability; risk is concentrated in multi-tenant or shared-hosting environments where untrusted local users coexist with processes passing sensitive data through this module.
Local partial denial-of-service in Oracle GoldenGate Stream Analytics 26.1.0.0.0 allows a low-privileged attacker with logon access to the host infrastructure to degrade availability of the analytics service. The vulnerability resides in the Security component and requires no user interaction once local access is established. No public exploit code has been identified at time of analysis, and the low CVSS score of 3.3 reflects a limited, non-critical impact confined to availability.
Local unauthorized data read in Oracle Data Integrator's Patchset Assistant component allows a low-privileged user with local logon access to the ODI host to read a subset of data they are not entitled to access. Affected versions are 12.2.1.4.0 and 14.1.2.0.0 as confirmed by Oracle's July 2026 Critical Patch Update. With a CVSS 3.1 score of 3.3, no KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to insider threat or compromised local account scenarios on ODI infrastructure hosts.
Local privilege information disclosure in Oracle Retail Xstore Point of Service 21.0.3 allows low-privileged users with system logon access to read a subset of Xstore data they are not authorized to view via the Xstore Mobile component. Despite carrying the 'Authentication Bypass' tag, the CVSS vector (AV:L/PR:L) confirms exploitation requires existing local infrastructure access - the bypass likely permits an authenticated low-privilege user to circumvent authorization controls and access restricted data segments. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unlikely in the near term.
Local privilege abuse in Oracle VM VirtualBox 7.2.12 Core component permits a high-privileged local attacker to read a subset of VirtualBox-accessible data, with confirmed scope change indicating potential exposure of data belonging to co-hosted or adjacent products. The CVSS score of 3.2 (Low) reflects the constrained attack surface - requiring local logon with high privileges - but the scope change flag (S:C) elevates the architectural concern, as information disclosed may originate outside the directly compromised VirtualBox instance. No public exploit code or active exploitation has been identified at time of analysis.
Oracle VM VirtualBox 7.2.12 Core component exposes a local information disclosure path that allows a high-privileged host-level attacker to read a subset of VirtualBox-accessible data, with scope change indicating that impact can extend beyond the hypervisor process itself to adjacent resources such as guest VMs. The vulnerability is rated CVSS 3.2 (Low) and is confirmed by Oracle's July 2026 Critical Patch Update; no public exploit code and no CISA KEV listing exist. The combination of local-only access and mandatory high privileges severely constrains real-world exploitability, making this a low-priority finding for most organizations outside multi-tenant or shared-host VirtualBox deployments.
Oracle VM VirtualBox 7.2.12 Core component contains a local integrity vulnerability enabling a highly privileged attacker with host logon access to make unauthorized modifications to VirtualBox-accessible data, with potential cross-boundary impact on additional products due to scope change (S:C). The constraint to local, high-privilege access (AV:L/PR:H) limits the realistic threat surface to insider threats or post-compromise scenarios on hypervisor hosts. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Partial denial of service in Oracle Inventory Optimization (E-Business Suite versions 12.2.3 through 12.2.15) can be triggered by a low-privileged attacker over HTTP, causing degraded availability of the User Interface component. The vulnerability carries a CVSS 3.1 base score of 3.1, reflecting high attack complexity and limited impact scope. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the July 2026 Critical Patch Update.
Partial denial-of-service in Oracle Labor Distribution (E-Business Suite versions 12.2.3 through 12.2.15) is exploitable by low-privileged authenticated attackers over HTTP under high-complexity conditions. The vulnerability affects only the availability of the Internal Operations component and yields only a partial availability impact, placing it firmly in the low-severity tier. No public exploit code exists and no active exploitation has been identified at the time of analysis.
Unauthorized read access in Oracle Project Contracts (E-Business Suite component: Internal Operations) can be achieved by a low-privileged network attacker under high-complexity exploit conditions, exposing a subset of Project Contracts data. Affected versions span 12.2.3 through 12.2.15, as confirmed by Oracle Security Alerts via the July 2026 Critical Patch Update. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, keeping real-world risk low despite the network-accessible attack surface and the notable 'Authentication Bypass' tag applied by ENISA EUVD.
Partial unauthorized read access in Oracle Public Sector Financials (E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker over HTTP to read a limited subset of data they are not authorized to access. Despite the 'Authentication Bypass' tag in intelligence sources, the CVSS vector confirms authentication is required (PR:L), suggesting this is a partial authorization bypass or privilege boundary failure rather than a full authentication bypass. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized read access to a subset of procurement data is achievable in Oracle iSupplier Portal versions 12.2.3 through 12.2.15 via the Internal Operations component over HTTP, requiring a low-privileged account and difficult attack conditions. The intelligence tags classify this as an Authentication Bypass, creating tension with the official CVSS PR:L metric - if bypass is possible, the real-world requirement may be lower than the vector implies. No public exploit or active exploitation has been identified at time of analysis; this vulnerability is addressed in Oracle's July 2026 Critical Patch Update.