Agile Product Lifecycle Management For Process
CVE-2026-21944
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
AnalysisAI
Agile Product Lifecycle Management For Process versions up to 6.2.4 is affected by cross-site scripting (xss) (CVSS 6.5).
Technical ContextAI
This vulnerability (CWE-79: Cross-site Scripting (XSS)) affects Agile Product Lifecycle Management For Process. Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile Product
RemediationAI
Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), thi
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible when a remote, unauthentica
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible by an unauthenticated remot
Oracle Agile PLM for Process has a CVSS 9.8 vulnerability in the Supply Chain Sourcing component that allows unauthentic
Unauthenticated remote compromise of Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Manage
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management compone
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management compone
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Pr
Sensitive data compromise in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management com
Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows a l
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today