Inventory Management
Monthly
Oracle Inventory Management within Oracle E-Business Suite 12.2.3 through 12.2.15 is susceptible to a local, highly constrained partial denial-of-service condition affecting only availability. Exploitation requires an already highly privileged attacker with direct logon access to the underlying infrastructure hosting the application, combined with high attack complexity, making successful exploitation extremely difficult in practice. No public exploit code or active exploitation has been identified; the CVSS score of 1.9 reflects the minimal real-world risk posed by this vulnerability.
Full takeover of Oracle Inventory Management (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with local infrastructure access exploiting a flaw in the Internal Operations component. The CVSS vector (AV:L/AC:H/PR:H) places this firmly in the category of post-compromise or insider-threat scenarios rather than remote opportunistic attacks, yet the confirmed C:H/I:H/A:H impact means a successful exploitation yields complete control of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Inventory Management (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the application, with a scope change that can significantly impact other Oracle EBS products. Rated CVSS 3.1 7.7 (confidentiality-only), the flaw is easily exploitable over HTTP and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle E-Business Suite Inventory Management (Core Receiving component, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete or modify all data accessible to the Inventory Management module over HTTP. The flaw is rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, and is trivially exploitable (AC:L) once the attacker holds any valid low-privilege EBS session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw may let a low-privilege account reach functionality or data it should not.
A vulnerability was found in code-projects Inventory Management up to 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Inventory Management 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.php component. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the registration.php component. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php component. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Oracle Inventory Management within Oracle E-Business Suite 12.2.3 through 12.2.15 is susceptible to a local, highly constrained partial denial-of-service condition affecting only availability. Exploitation requires an already highly privileged attacker with direct logon access to the underlying infrastructure hosting the application, combined with high attack complexity, making successful exploitation extremely difficult in practice. No public exploit code or active exploitation has been identified; the CVSS score of 1.9 reflects the minimal real-world risk posed by this vulnerability.
Full takeover of Oracle Inventory Management (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with local infrastructure access exploiting a flaw in the Internal Operations component. The CVSS vector (AV:L/AC:H/PR:H) places this firmly in the category of post-compromise or insider-threat scenarios rather than remote opportunistic attacks, yet the confirmed C:H/I:H/A:H impact means a successful exploitation yields complete control of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Inventory Management (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the application, with a scope change that can significantly impact other Oracle EBS products. Rated CVSS 3.1 7.7 (confidentiality-only), the flaw is easily exploitable over HTTP and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle E-Business Suite Inventory Management (Core Receiving component, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete or modify all data accessible to the Inventory Management module over HTTP. The flaw is rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, and is trivially exploitable (AC:L) once the attacker holds any valid low-privilege EBS session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw may let a low-privilege account reach functionality or data it should not.
A vulnerability was found in code-projects Inventory Management up to 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as critical was found in code-projects Inventory Management 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.php component. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the registration.php component. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php component. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.