Configurator

CVE-2025-61884 Oct 12, 03:15 HIGH POC KEV THREAT Act Now

Unauthenticated path traversal in Oracle Configurator's Runtime UI (part of Oracle E-Business Suite 12.2.3-12.2.14) exposes the complete data accessible to the Configurator application over plain HTTP with no prerequisites. The CISA KEV catalog references this CVE, and watchTowr Labs has published a pre-authentication RCE chain combining this flaw with CVE-2025-61882 - meaning confidentiality loss is the isolated impact, but chaining enables full system compromise. A publicly available exploit exists, and the July 2025 Oracle Critical Patch Update (CPU) addresses this vulnerability.

CVE-2026-21972 Jan 20, 22:16 MEDIUM This Month

Configurator contains a vulnerability that allows attackers to unauthorized read access to a subset of Oracle Configurator accessible data (CVSS 5.3).

CVE-2025-30728 Apr 15, 21:16 HIGH PATCH This Week

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2025-30720 Apr 15, 21:16 MEDIUM This Month

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Orders). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-43986 Oct 19, 19:15 CRITICAL Act Now

DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component ConfiguratorAttachment::getAttachmentByToken. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2080 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2079 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2078 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-14669 Jul 15, 18:15 HIGH This Week

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2865 Apr 15, 14:15 MEDIUM This Month

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: Installation). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2019-2567 Apr 23, 19:32 HIGH PATCH This Week

Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite (subcomponent: Active Model Generation). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2016-3438 Apr 21, 11:00 HIGH This Week

Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2016-0541 Jan 21, 03:01 MEDIUM This Month

Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect confidentiality via unknown vectors. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2016-0540 Jan 21, 03:01 MEDIUM This Month

Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect confidentiality via unknown vectors. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.