Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with HTTP network access, exploiting a flaw in the Security component. Oracle's own description characterizes the outcome as complete compromise, with CVSS 3.1 confirming full confidentiality, integrity, and availability impact (C:H/I:H/A:H), making this more severe than the accompanying 'Information Disclosure' tag suggests. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Purchasing, a procurement module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity network-exploitable vulnerability in its Internal Operations component that enables full system takeover - complete loss of confidentiality, integrity, and availability. Oracle itself classifies this as 'easily exploitable' despite the high-privilege requirement (PR:H), meaning that once an attacker possesses elevated credentials, exploitation presents no meaningful technical barrier. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the full CIA impact and low attack complexity make this a priority patching target for any organization running internet-exposed or broadly network-accessible Oracle EBS deployments.
Full system takeover of Oracle Cost Management (versions 12.2.3-12.2.15) is achievable by a highly privileged network attacker via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Cost Planning component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable' - meaning low attack complexity once credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers to bypass authentication controls via HTTP, resulting in unauthorized read access to a subset of application data and the ability to insert, update, or delete accessible records. The CVSS scope change (S:C) indicates successful exploitation can affect additional systems beyond the Helidon instance itself - a compounding factor in microservices topologies where Helidon acts as a gateway or intermediary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated, low-complexity attack path makes this credible against any internet-exposed deployment.
Unauthenticated remote exploitation of the Imperative Web Server component in Oracle Helidon 4.5.0 allows network-accessible attackers to perform unauthorized read and write operations against application-accessible data, with confirmed scope change indicating downstream impact on adjacent systems beyond the directly targeted Helidon instance. The vulnerability is tagged as an authentication bypass, meaning the HTTP-exposed service fails to enforce access controls on one or more endpoints. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though Oracle's Critical Patch Update advisory for August 2026 confirms the vulnerability's existence and assigns a CVSS 3.1 score of 7.2.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server allows remote unauthenticated attackers to read a subset of application data and make unauthorized modifications via HTTP, with a scope change indicating potential cascade impact to downstream services. The CVSS 3.1 score of 7.2 (High) is elevated by the scope change (S:C), reflecting Helidon's common role as a gateway or orchestrator in microservices architectures. No public exploit or CISA KEV listing has been identified at time of analysis, but the fully unauthenticated, low-complexity, network-accessible attack profile makes this a credible and time-sensitive patching priority for any internet-exposed deployment.
Authentication bypass in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability carries a scope-change designation (S:C in CVSS), meaning successful exploitation may cascade beyond Helidon itself to impact additional products or services in the surrounding microservices environment. No public exploit code or active exploitation has been confirmed at time of analysis, but the zero-prerequisite attack profile - no authentication, low complexity, no user interaction - makes this straightforward to exploit once the bypass mechanism is understood.
Unauthenticated network exploitation of Oracle Helidon 3.2.19's Imperative Web Server component allows remote attackers to bypass authentication over HTTP, gaining unauthorized read access to a subset of data and the ability to insert, update, or delete accessible data. The CVSS S:C scope change is particularly significant: in microservices environments where Helidon acts as a service layer, successful exploitation may cascade to impact downstream or co-located systems beyond the initially compromised component. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the zero-prerequisites attack profile (AV:N/AC:L/PR:N/UI:N) and scope change make this a prioritized patching target for any organization running the affected version.
Unauthenticated remote exploitation of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via HTTP allows attackers to read a subset of accessible data and perform unauthorized data modification (insert, update, delete) through the Endeca Application Controller component. The scope change indicator in the CVSS vector (S:C) signals that successful attacks can impact systems beyond the directly targeted instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-authentication, network-accessible attack surface lowers the bar for exploitation significantly.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 via SMTP allows attackers to perform unauthorized data manipulation and cause a partial denial of service against the affected instance. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-change designation indicating that successful attacks may cascade to impact additional Oracle products sharing the same environment. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated SSRF in OttoKit WordPress plugin (≤1.1.35) allows any remote attacker without credentials to coerce the host server into making arbitrary outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The CVSS S:C (Scope Changed) rating confirms the vulnerability crosses security boundaries beyond the WordPress instance itself, enabling internal network reconnaissance, credential harvesting from cloud metadata services (e.g., AWS IMDSv1), or interaction with internal APIs. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated Server-Side Request Forgery in PDF Smart Viewer for Elementor (WordPress plugin by Deknows, versions up to and including 1.0.4) allows any remote, unauthenticated attacker to coerce the WordPress server into issuing arbitrary HTTP requests to attacker-controlled destinations. With a CVSS scope change (S:C), this vulnerability can be leveraged to probe and interact with internal network services not directly exposed to the internet, including cloud metadata endpoints, internal APIs, and adjacent infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry (PR:N, UI:N, AC:L) makes it trivially scriptable.
Remote File Inclusion in the Easy Google Maps WordPress plugin (versions below 1.14.2) by Supsystic exposes unauthenticated remote attackers to include arbitrary external files into the server-side execution context with no credentials or user interaction required. The CVSS scope change (S:C) indicates impact extends beyond the plugin itself to the broader WordPress installation, enabling limited confidentiality and integrity compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-prerequisite attack surface makes this a meaningful priority for any site running the affected plugin.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a high-privileged, network-exploitable vulnerability in its Security component that enables complete unauthorized read access to all data accessible by the application, with additional limited integrity and availability impacts. The CVSS scope change (S:C) is a critical signal: successful exploitation can significantly affect other products within the same Oracle Hyperion suite deployment, amplifying organizational risk beyond the directly targeted component. No public exploit identified at time of analysis, and no CISA KEV listing; however, the combination of scope change and high confidentiality impact warrants prioritization in Oracle Hyperion deployments.
Unauthenticated remote exploitation of the Endeca Application Controller in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 permits attackers to read a subset of application data and perform unauthorized inserts or modifications over HTTP without any credentials. The vulnerability carries a confirmed scope change, meaning successful exploitation can propagate impact into adjacent Oracle Commerce components beyond the directly targeted service. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-friction exploitation path - no authentication, no user interaction, low complexity - makes this an attractive opportunistic target for any attacker able to reach the exposed HTTP service.
Stored Cross-Site Scripting in the Quill Forms WordPress plugin (all versions through 5.7.1) enables unauthenticated attackers to permanently inject arbitrary JavaScript into pages rendered by the plugin. The CVSS vector (PR:N, S:C) confirms no authentication is needed to plant the payload, and the scope change indicates injected scripts execute in victims' browser sessions - enabling session hijacking, credential theft, or admin account takeover when privileged users view affected pages. Reported by Wordfence and corroborated by Patchstack; no public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, allowing a high-privileged local attacker to achieve unauthorized read and write access to critical data with scope impact extending beyond the Order Management module itself. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) confirms that exploitation is constrained to infrastructure-level access, requiring both physical or logical logon to the host system and an elevated account, but successful exploitation yields complete confidentiality and integrity compromise. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Local code execution and data compromise in Oracle PeopleSoft Enterprise PeopleTools (Data Mover component) affects versions 8.61 through 8.63, requiring a highly privileged attacker with physical or logical infrastructure access and human interaction from a secondary party. Successful exploitation results in full confidentiality and integrity compromise of PeopleTools data, potential modification or deletion of critical records, and partial denial of service, with a confirmed scope change that can cascade impact to additional dependent PeopleSoft products. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Oracle CSPU August 2026 advisory confirms this as a patched, vendor-acknowledged vulnerability.
Oracle General Ledger versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, contains an authentication bypass weakness in the Internal Operations component that allows a highly privileged local attacker to gain unauthorized read and write access to critical financial ledger data, with a scope change that may cascade impact to additional Oracle EBS products. The attack requires local infrastructure logon and high attack complexity, substantially constraining the realistic attacker population to insiders or those who have already compromised the host environment. No public exploit code has been identified and Oracle has addressed this through the August 2026 Critical Patch Update.
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Applications DBA, the administrative component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, exposes critical internal operations over HTTP to low-privileged attackers. Successful exploitation enables unauthorized access to critical or complete data accessible by the Applications DBA component, along with the ability to trigger partial denial-of-service conditions against the same component. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the low complexity and broad network accessibility make it a meaningful risk in unpatched EBS deployments.
Broken authentication in MWB HubSpot for WooCommerce versions 1.6.7 and earlier allows subscriber-level authenticated WordPress users to bypass access controls and invoke functionality reserved for higher-privileged roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) places the primary impact on availability (High), with limited integrity impact and no confirmed confidentiality exposure - notable given the 'Information Disclosure' tag applied by Patchstack, which is not reconciled by the official scoring. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 are achievable by any low-privileged, network-connected attacker via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per vendor-assigned tags, involves an authentication bypass mechanism that elevates effective access beyond the attacker's granted privileges, enabling exposure of critical financial data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog; however, the low attack complexity and broad network exposure make it a high-priority remediation target for organizations running the affected release.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all financial data accessible within the application and degrade service availability via HTTP. The 'Authentication Bypass' tag suggests the Security component vulnerability enables privilege escalation beyond the attacker's granted role, exposing sensitive financial consolidation data. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, network accessibility, and high confidentiality impact against enterprise financial data makes this a meaningful priority for affected organizations.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by any low-privileged attacker with network access over HTTP targeting the Deployment component. The combination of a high confidentiality impact and an 'Authentication Bypass' tag from EUVD suggests the flaw may allow authenticated users to escalate access beyond their authorization level, potentially exposing all financial and operational data managed by the platform. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has addressed this in the August 2026 Critical Security Patch Update.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes critical data and partial availability loss to low-privileged network attackers via a flaw in its Security component, accessible over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy network exploitation requiring only a low-privilege account with no interaction, yielding high confidentiality impact and partial denial of service. Notably, the 'Authentication Bypass' tag in the intelligence data suggests the effective exploitation barrier may be lower than the PR:L metric implies. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized data disclosure and partial service disruption affect Oracle Siebel CRM's Marketing component across versions 17.0 through 26.6, exploitable by a low-privileged authenticated attacker via HTTP without requiring user interaction. The flaw enables complete read access to all data within the Siebel Apps - Marketing scope alongside degraded service availability, as confirmed by Oracle's August 2026 Critical Security Patch Update. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Oracle Warehouse Management versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged network-authenticated attackers to corrupt, delete, or create critical warehouse data and partially disrupt service availability over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy exploitability requiring only a low-privilege account and HTTP connectivity - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; the August 2026 Oracle Critical Patch Update references a fix.
Oracle WebCenter Portal's Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable over HTTP by unauthenticated remote attackers, subject to victim user interaction, enabling unauthorized modification or deletion of portal data and a partial denial of service. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector confirms low-complexity network exploitation requiring no credentials, only that a victim user be induced to interact with attacker-controlled content. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's August 2026 Critical Patch Update.
Remote authentication bypass in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to gain unauthorized access to all content managed by the platform and perform limited data modification, provided a victim user interacts with attacker-controlled material. The Oracle August 2026 CPU advisory confirms both supported release trains are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of unauthenticated network access, low complexity, and a high confidentiality impact makes this a priority patch for any Oracle Fusion Middleware deployment.
Authenticated low-privileged network exploitation of Oracle Financials for Asia/Pacific (versions 12.2.3-12.2.15) enables unauthorized creation, deletion, or modification of critical financial data, with partial read access to additional records. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is reachable over HTTP without user interaction. No public exploit or active KEV listing has been identified at time of analysis, though Oracle classifies it as 'easily exploitable,' and the 'Authentication Bypass' tag suggests the low-privilege requirement may be bypassed or trivially satisfied under certain conditions.
Unauthorized data access in Oracle Financials for EMEA (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-accessible attacker to exfiltrate critical financial data and perform limited data manipulation via HTTP. The 'Authentication Bypass' tag from ENISA EUVD suggests the flaw in the Internal Operations component permits privilege escalation beyond what the authenticated identity should authorize - effectively letting a standard user reach data reserved for higher roles. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across a financial ERP increase urgency for EMEA-facing Oracle deployments.
Unauthorized data access and partial data manipulation in Oracle Landed Cost Management (versions 12.2.3 through 12.2.15) is exploitable by low-privileged, network-accessible attackers via HTTP, with no user interaction required. Tagged as an Authentication Bypass, the vulnerability in the Internal Operations component allows an authenticated low-privilege user to exceed their authorization, gaining complete read access to all data accessible by the module and limited write/insert/delete capability. No public exploit has been identified at time of analysis and the flaw is not listed in the CISA KEV catalog.
Oracle Financials for EMEA (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to gain unauthorized read access to critical financial data and perform limited unauthorized write operations via HTTP. The vulnerability resides in the Internal Operations component and, despite requiring an existing account, carries a High confidentiality impact given the sensitivity of EMEA financial records involved. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and absence of user-interaction requirements make this a realistic post-authentication privilege escalation path.
Unauthorized data access and partial data manipulation in Oracle Siebel CRM's Data Archival component exposes critical CRM data to low-privileged network attackers via HTTP. Affected versions 25.12 through 26.6 allow an authenticated low-privileged user to gain complete read access to all Siebel CRM Administration accessible data and perform unauthorized write operations on a subset of that data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's authorized scope within the application.
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File Transmission) across versions 12.2.3 through 12.2.15 via an authentication bypass exploitable over HTTP. A low-privileged network attacker can obtain complete read access to all Oracle Payments data and perform unauthorized insert, update, or delete operations against a subset of that data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'easily exploitable' vendor classification combined with low attack complexity elevates real-world risk for unpatched EBS environments.
Full system takeover of Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a low-privileged, network-connected attacker exploiting the Content Server component via HTTP, provided a separate victim user performs some form of interaction. Despite the severe outcome - complete compromise of confidentiality, integrity, and availability - the CVSS vector signals above-average exploitation complexity (AC:H) and a mandatory human-interaction requirement (UI:R), meaning opportunistic, automated attacks are unlikely. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Unauthorized data exposure and partial denial-of-service in Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read critical or complete CMRO application data across a scope boundary into additional Oracle E-Business Suite components. The vulnerability resides in the Production component and is exploitable over HTTP without user interaction, though high attack complexity limits opportunistic exploitation. No public exploit code or CISA KEV listing exists at time of analysis; Oracle has issued remediation via the August 2026 Critical Patch Update.
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes its Installation and Configuration component to network-based exploitation by low-privileged authenticated attackers over HTTP, enabling unauthorized access to critical EPM platform data and limited data manipulation. The vulnerability is tagged as an Authentication Bypass, suggesting that a user authenticated at low privilege can circumvent authorization controls to access data scoped to higher privilege levels - consistent with the CVSS C:H/I:L impact profile. No public exploit has been identified at time of analysis, and the issue was patched as part of Oracle's Critical Patch Update for August 2026.
Oracle Loans within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes all loan records to network-authenticated low-privileged users through an authorization control failure in the Internal Operations component. A low-privileged attacker with HTTP network access can read the complete Oracle Loans dataset and perform unauthorized inserts or updates on a subset of that data, without requiring elevated credentials or any victim interaction. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update.
Oracle Scripting within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes a network-accessible vulnerability in the Internal Operations component, allowing a low-privileged authenticated attacker to gain complete unauthorized read access to all Oracle Scripting-accessible data and limited write access via HTTP. The vulnerability carries an Authentication Bypass tag, indicating the flaw permits privilege escalation beyond the attacker's intended authorization level within the module. No public exploit code or active exploitation has been identified at time of analysis, though Oracle itself characterizes the vulnerability as easily exploitable, elevating urgency despite the absence of a CISA KEV listing.
Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial planning data to low-privileged network attackers through its Deployment component over HTTP. Tagged as an authentication bypass, the vulnerability permits a credentialed user to gain complete read access to all data accessible within the application and perform limited unauthorized insert, update, or delete operations, without requiring user interaction or elevated privileges beyond an initial low-level account. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity (AC:L) means a skilled attacker with any valid credential could exploit this reliably.
Oracle Sales within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes an authorization flaw in its Internal Operations component that enables low-privileged authenticated network attackers to access all Oracle Sales data they should not be authorized to view, and perform limited unauthorized data manipulation via HTTP. The CVSS 3.1 score of 7.1 reflects a high confidentiality impact - complete access to all Oracle Sales accessible data - combined with a low integrity impact allowing unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the ease of exploitation (AC:L, no UI required) combined with the data sensitivity of a CRM/sales platform makes this a meaningful organizational risk.
Oracle Scripting versions 12.2.3 through 12.2.15 within Oracle E-Business Suite exposes an Internal Operations component vulnerability allowing low-privileged, network-based attackers to achieve full confidentiality and integrity compromise of all Scripting-accessible data, plus partial service disruption. The "Authentication Bypass" tag from the intelligence feed creates a notable tension with the CVSS PR:L assignment - if the bypass allows unauthenticated users to obtain a low-privilege session context, the effective attack surface is wider than the CVSS vector alone suggests. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H rating constrains opportunistic exploitation.
Unauthorized data access and modification in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a low-privileged network attacker targeting the Internal Operations component via HTTP. Successful exploitation grants complete read and write access to critical GL financial data plus partial availability disruption - a severe outcome for any organization relying on EBS for financial record integrity. The 'Authentication Bypass' tag suggests the vulnerability allows a low-privileged authenticated user to escalate effective access beyond their authorization level; no public exploit code or CISA KEV listing has been identified at time of analysis.
CPU exhaustion in Wazuh Manager 4.0.0-4.14.6 and 5.0.0-beta2 allows authenticated API users with the allow_run_as permission to fully deny service to all other API consumers by submitting arbitrarily deeply nested JSON to the POST /security/user/authenticate/run_as endpoint. The API framework processes these structures recursively without any depth or size limit, consuming CPU proportionally to nesting depth until the process becomes unresponsive. No public exploit identified at time of analysis, though the attack primitive is trivially constructible from the CVE description alone.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes a network-accessible flaw allowing low-privileged authenticated attackers via HTTP to read critical or all accessible application data and cause partial availability disruption. The CVSS 3.1 score of 7.1 reflects high confidentiality impact combined with low availability impact, with no integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Commerce Experience Manager 11.4.0 exposes a network-accessible flaw in its Experience Manager component that permits low-privileged authenticated attackers to gain complete unauthorized access to all platform data and cause partial availability degradation via HTTP. The CVSS 3.1 score of 7.1 reflects high confidentiality impact with no integrity exposure, consistent with an authorization bypass or excessive data access pattern rather than code execution. No public exploit or CISA KEV listing exists at time of analysis; however, the intelligence tag 'Authentication Bypass' introduces a discrepancy with the PR:L metric that warrants verification against the full Oracle advisory.
Unauthorized data exfiltration and partial service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by low-privileged network attackers via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per the 'Authentication Bypass' tag, likely involves improper enforcement of access controls that permits a low-privileged user to read data far beyond their authorization level, achieving complete access to all Financial Management accessible data (C:H). No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to leverage for any authenticated user of the application.
Path traversal in Grav Plugin API versions 1.0.0-beta.10 through 1.0.14 enables an authenticated editor-level user to write attacker-controlled page content and media to arbitrary filesystem locations accessible to the web server process. The root cause is an incomplete fix for a prior related path traversal (GHSA-qjq4-jp55-4mx2) that left the 'suffix' parameter of the PagesController::batchCopy() method unvalidated against directory escape sequences. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patch version 1.0.15 resolves the issue.