Istore

CVE-2026-60817 Jul 21, 22:18 HIGH This Week

Broken access control in the Shopping Cart component of Oracle iStore (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the iStore application over HTTP. Tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 8.1 driven by high confidentiality and integrity impact with no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.

CVE-2026-60813 Jul 21, 22:18 HIGH This Week

Full takeover of Oracle iStore (the Oracle E-Business Suite customer-facing web storefront) is possible via its Shopping Cart component in releases 12.2.3 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and shipped a fix in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

CVE-2026-60816 Jul 21, 22:18 MEDIUM This Month

Unauthorized read access to critical data is possible in Oracle iStore (E-Business Suite Shopping Cart component, versions 12.2.3-12.2.15) via an authentication bypass condition exploitable by low-privileged network attackers over HTTP. The attack is rated difficult to exploit (AC:H), limiting opportunistic risk, but a successful attempt yields high confidentiality impact - complete access to all iStore-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Oracle via their July 2026 Critical Patch Update.

CVE-2026-60815 Jul 21, 22:18 MEDIUM This Month

Cross-site injection in Oracle iStore's Shopping Cart component (E-Business Suite versions 12.2.3-12.2.15) enables unauthenticated remote attackers to read a subset of iStore-accessible data and perform unauthorized data modifications, with a scope change indicating impact can extend to adjacent Oracle E-Business Suite modules. The attack requires victim interaction via HTTP but no credentials, and Oracle has published a fix in the July 2026 Critical Patch Update. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the vendor-assigned tag of 'Authentication Bypass' suggests the client-side injection may circumvent session-level controls beyond what the CVSS score alone implies.

CVE-2025-53041 Oct 21, 20:20 MEDIUM This Month

Improper access control in the Shopping Cart component of Oracle iStore, the storefront module of Oracle E-Business Suite 12.2.5 through 12.2.14, allows an unauthenticated remote attacker sending crafted HTTP requests to read and to insert, update, or delete a subset of iStore-accessible data. Exploitation is not fully automatable: the CVSS vector (PR:N/UI:R) requires a person other than the attacker to click a crafted link or otherwise interact with attacker-supplied content, so delivery realistically depends on phishing or social engineering, and the scope change (S:C) means affected data or logic may extend into other Oracle EBS products. Impact is bounded to limited confidentiality and integrity loss with no availability impact, no public exploit code has been identified at time of analysis, and EPSS is low at 0.23% (13th percentile), making this a moderate, lower-priority issue despite the widely deployed platform.

CVE-2025-30707 Apr 15, 21:16 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2024-21143 Jul 16, 23:15 MEDIUM This Month

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Management). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-20938 Jan 16, 22:15 MEDIUM PATCH This Month

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: ECC). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2241 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-2199 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2197 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2188 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2187 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2186 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2185 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2184 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2183 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2182 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2150 Apr 22, 22:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2021-2096 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2089 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Runtime Catalog). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2082 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2077 Jan 20, 15:15 HIGH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2059 Jan 20, 15:15 MEDIUM This Month

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Web interface). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-14596 Jul 15, 18:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Address Book). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2020-14582 Jul 15, 18:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: User Registration). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2020-2810 Apr 15, 14:15 MEDIUM This Month

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2582 Jan 15, 17:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-2990 Oct 16, 18:15 HIGH PATCH This Week

Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Order Tracker). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-2652 Apr 23, 19:32 HIGH PATCH This Week

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2018-3188 Oct 17, 01:31 HIGH PATCH This Week

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Web interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2018-3018 Jul 18, 13:29 HIGH PATCH This Week

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2018-2995 Jul 18, 13:29 HIGH PATCH This Week

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Shopping Cart). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2018-2994 Jul 18, 13:29 MEDIUM PATCH This Month

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Shopping Cart). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10414 Oct 19, 17:29 HIGH PATCH This Week

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Checkout and Order Placement). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10409 Oct 19, 17:29 HIGH PATCH This Week

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Merchant UI). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10192 Aug 08, 15:29 MEDIUM PATCH This Month

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Shopping Cart). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10186 Aug 08, 15:29 MEDIUM PATCH This Month

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User and Company Profile). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-10130 Aug 08, 15:29 HIGH PATCH This Week

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Management). Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity.

CVE-2017-10112 Aug 08, 15:29 HIGH PATCH This Week

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Registration). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3368 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: Address Book). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2017-3287 Jan 27, 22:59 HIGH PATCH This Week

Vulnerability in the Oracle iStore component of Oracle E-Business Suite (subcomponent: User Interface). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2016-5489 Oct 25, 14:29 HIGH PATCH This Week

Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 12.1.1 through 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.