Agile Product Lifecycle Management For Process

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows a low-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity, and availability impact. The Oracle July 2026 Critical Patch Update rates this CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit is identified at time of analysis and it is not listed in CISA KEV.

Unauthorized data disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows an unauthenticated attacker on the adjacent network segment to compromise confidentiality and, due to a scope change, impact additional connected products. The flaw is rated CVSS 3.1 7.4 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, and it was disclosed by Oracle in the July 2026 Critical Patch Update.

Unauthenticated remote compromise of Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets network attackers read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 9.1 driven by full confidentiality and integrity impact, and community tagging labels it an authentication bypass. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.

Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible when a remote, unauthenticated attacker reaches the Reporting component over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (C:H/I:H/A:H) reflects that a successful attack yields full confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high patch priority.

Full system takeover is achievable in Oracle Agile Product Lifecycle Management for Process 6.2.4 via the Data Import component, exploitable by a high-privileged attacker with local infrastructure access. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability despite the constrained attack surface. No public exploit code or CISA KEV listing exists at time of analysis, limiting immediate real-world risk to insider threat and post-compromise escalation scenarios.

Sensitive data compromise in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets a low-privileged, network-authenticated attacker read all application-accessible data and make limited unauthorized modifications, with a scope change that can significantly impact additional products. Oracle rates it easily exploitable but it requires tricking a separate user into interaction (UI:R), yielding a CVSS 3.1 base score of 7.6. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise confidentiality, integrity, and availability over HTTP. Oracle rates this 8.8 and describes it as 'easily exploitable,' meaning any user holding a valid low-level account can escalate to full application control. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and high impact make it a strong patch priority.

Full product takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) allows a low-privileged, network-authenticated attacker to compromise the entire application over HTTP. Oracle rates the flaw as easily exploitable with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and it is not on CISA KEV; the only source is Oracle's July 2026 Critical Patch Update.

Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the product's Installation component and yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Oracle Agile PLM for Process has a CVSS 9.8 vulnerability in the Supply Chain Sourcing component that allows unauthenticated remote attackers to fully compromise the system.

Agile Product Lifecycle Management For Process versions up to 6.2.4 is affected by cross-site scripting (xss) (CVSS 6.5).

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Data Import). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the Advanced Networking Option component of Oracle Database Server. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite (subcomponent: User Group Management). Rated medium severity (CVSS 5.0).

Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite (subcomponent: Installation). Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle Agile Product Lifecycle Management for Process component of Oracle Supply Chain Products Suite (subcomponent: Installation). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.1.0.4, 6.1.1.6, and 6.2.0.0 allows local users to affect. Rated medium severity (CVSS 4.1). This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.