Peoplesoft Enterprise Peopletools
Monthly
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 expose an exploitable flaw in the SQR component that lets a low-privileged, authenticated user reach the service over HTTP and read data well beyond their intended authorization while also crashing or repeatedly hanging the application. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) the attacker needs a valid account but no elevated role and no victim interaction, and the confidentiality impact is rated total for data accessible through PeopleTools, with a matching high availability impact from the resulting denial of service. Oracle rates this 8.1 and released it in its Critical Security Patch Update cycle; no EPSS score, CISA KEV listing, or public exploit code was supplied with the source data at time of analysis.
Local, low-privileged compromise of the SQR component in Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets an attacker who already holds a logon to the host where PeopleTools runs take full control of the PeopleTools instance, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). The flaw is rated easily exploitable once host access exists (AC:L, PR:L, UI:N), but the AV:L vector means it is not remotely reachable from the network without some foothold on the target infrastructure. The provided intelligence contains no EPSS score, no CISA KEV listing and no public exploit reference, so no public exploit was identified at time of analysis, though the code-execution outcome makes this a high-value post-compromise escalation path.
Low-privileged attackers with network access to the HTTP interface of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Report Distribution component to achieve full takeover of the PeopleTools application, with high impact to confidentiality, integrity, and availability. Oracle rates the issue 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), characterizing it as easily exploitable because it needs only a basic authenticated account and no user interaction. No public proof-of-concept or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be fully taken over through a flaw in its SQR component, but only by an attacker who already holds a high-privileged logon on the host where PeopleTools runs and who can persuade another user to perform an interaction. Oracle rates it 7.2 because a successful attack is difficult to execute yet delivers complete loss of confidentiality, integrity and availability, and because the compromise can spill over into connected products (scope change). No public exploit code is identified and there is no CISA KEV entry, so the issue is a defensive hardening priority rather than an observed campaign.
Local takeover of Oracle PeopleSoft Enterprise PeopleTools (Cube Manager component) is possible for a low-privileged user who can log on to the infrastructure hosting the product, affecting versions 8.61 through 8.63. Oracle scores this 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a difficult-to-exploit but fully compromising flaw that yields high confidentiality, integrity and availability impact on the PeopleTools instance itself. No public exploit code or CISA KEV listing was identified at time of analysis, so the immediate threat is limited to actors who already hold a valid low-privileged account and interactive access to the PeopleSoft application tier.
A low-privileged, authenticated attacker with HTTP network access can exploit the Cube Manager component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to modify or delete critical data and to repeatedly crash or hang the application, producing a complete denial of service. Oracle rates the flaw 8.1 on the CVSS 3.1 scale with high integrity and availability impact but no confidentiality impact, and the vulnerability requires an existing valid account rather than being exploitable pre-authentication. No public proof-of-concept code or evidence of active exploitation was present in the supplied intelligence at the time of analysis.
PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain an authentication bypass in the Security component, exploitable by a low-privileged attacker with local infrastructure access to achieve full confidentiality and integrity compromise of PeopleTools data, with scope change enabling lateral impact across additional integrated Oracle products. The local attack vector (AV:L) and high complexity (AC:H) constrain exploitation to insider threats or post-compromise scenarios, but the S:C scope change and H/H confidentiality-integrity impact make successful exploitation highly consequential in large Oracle ERP environments. No public exploit code or active exploitation has been identified at time of analysis.
Full takeover of Oracle PeopleSoft Enterprise PeopleTools is achievable by an unauthenticated remote attacker targeting the nVision component via HTTP on versions 8.61 through 8.63. The attack requires that a victim user interact with attacker-controlled content - consistent with a client-side exploitation pattern such as XSS or CSRF - after which the attacker achieves complete compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and absence of any authentication requirement lower the bar for targeted exploitation against internet-accessible PeopleSoft deployments.
Local privilege escalation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 enables a low-privileged attacker with infrastructure logon access to achieve full system takeover via the Tuxedo middleware component. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires physical or session-level access to the host and involves high attack complexity, materially limiting opportunistic exploitation despite the complete CIA impact. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via its August 2026 Critical Security Patch Update.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) is achievable by a network-accessible, highly privileged attacker via a flaw in the PeopleCode component over HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - Oracle characterizes the outcome as a full 'takeover' of the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, and the PR:H requirement narrows the realistic attacker population to those already holding administrative-level credentials.
SQL-based exploitation in Oracle PeopleSoft Enterprise PeopleTools Configuration Manager (versions 8.61-8.63) enables a low-privileged authenticated attacker to achieve full system takeover over the network. The vulnerability is rated CVSS 8.8 High with complete Confidentiality, Integrity, and Availability impacts, and Oracle's own description characterizes it as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad enterprise deployment footprint make this a credible priority for organizations running affected PeopleTools versions.
Local code execution and data compromise in Oracle PeopleSoft Enterprise PeopleTools (Data Mover component) affects versions 8.61 through 8.63, requiring a highly privileged attacker with physical or logical infrastructure access and human interaction from a secondary party. Successful exploitation results in full confidentiality and integrity compromise of PeopleTools data, potential modification or deletion of critical records, and partial denial of service, with a confirmed scope change that can cascade impact to additional dependent PeopleSoft products. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Oracle CSPU August 2026 advisory confirms this as a patched, vendor-acknowledged vulnerability.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools (Install and Packaging component) versions 8.61 through 8.63 exposes critical HR and ERP data to unauthenticated network attackers over HTTP. Successful exploitation grants complete confidentiality and integrity compromise of all PeopleSoft-accessible data, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and CVSS AC:H rating indicates meaningful exploitation complexity, but the absence of any authentication requirement elevates organizational urgency.
Full system takeover is achievable against Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 via an unauthenticated HTTP attack targeting the Integration Broker component. The vulnerability carries a CVSS 3.1 score of 8.1 with complete confidentiality, integrity, and availability impact, though the AC:H metric indicates exploitation is not trivial and requires meeting specific attack complexity conditions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack path and full-takeover impact class make this a high-priority patching candidate for organizations running affected PeopleTools versions.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible via the Business Interlink component, where a remote unauthenticated attacker sending crafted HTTP requests can take over the product. Oracle rates this at CVSS 9.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch in the August 2026 Critical Patch Update.
Complete system takeover of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) is achievable by unauthenticated network attackers via HTTP, specifically through the PIA Core Technology component. Despite the high attack complexity rating (AC:H), successful exploitation yields full confidentiality, integrity, and availability compromise - effectively handing an attacker control over the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the impact warrants prioritized remediation through Oracle's August 2026 Critical Patch Update.
Unauthorized access to critical data in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible via the bundled OpenSearch Dashboards component, where a remote unauthenticated attacker can compromise confidentiality by luring a victim into interacting with attacker-supplied content (UI:R). The scope-change and confidentiality-only vector (S:C/C:H/I:N/A:N), combined with the vendor's 'Authentication Bypass' tag, is characteristic of a client-side flaw such as cross-site scripting in the Dashboards UI that lets an attacker read data across products the victim can reach. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Process Scheduler component) lets a low-privileged, network-reachable attacker read and modify critical data after luring a legitimate user into an interaction, with a scope change that can spill impact onto additional connected products. Oracle rates it CVSS 3.1 8.7 (C:H/I:H, no availability impact). No public exploit is identified at time of analysis and it is not in CISA KEV, but ease of exploitation and the cross-boundary scope change make it a notable item in the July 2026 Oracle Critical Patch Update.
Cross-site-scripting-style compromise of Oracle PeopleSoft Enterprise PeopleTools 8.62 (PIA Core Technology) lets a remote, unauthenticated attacker who lures an authenticated user into interacting with a crafted HTTP request achieve limited read/write access to PeopleSoft data and cause partial denial of service. The scope-change flag (S:C) means the impact can extend beyond PeopleTools into additional integrated products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 3.1 base score is 7.1.
Remote takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible through the Updates Environment Management component via unauthenticated HTTP requests. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation against any internet- or intranet-exposed instance, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' language and the unauthenticated nature make this a high-priority patching target.
Broad data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.62 allows a low-privileged, network-adjacent attacker to reach any data the platform can access. The flaw sits in the Security component and is characterized by improper access control (CWE-284, tagged as Authentication Bypass), letting an authenticated-but-unprivileged user read, create, delete, or modify critical data across the deployment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.03%), and it is not on CISA KEV.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthorized data access in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 allows a low-privileged, authenticated network attacker to read a subset of PeopleTools data and perform unauthorized insert, update, or delete operations via the Panel Processor component, with a confirmed scope change meaning successful exploitation can extend impact to additional dependent products. The attack carries high complexity and requires human interaction from a third-party victim. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though Oracle's tagging of 'Authentication Bypass' suggests the Panel Processor may allow privilege escalation beyond what the attacker's credential level should permit.
Cross-site or client-side injection in Oracle PeopleSoft Enterprise PeopleTools Panel Processor (versions 8.61 and 8.62) enables unauthenticated remote attackers to achieve limited unauthorized data read and write access by luring an authenticated user into interacting with a crafted HTTP request. The attack requires no privileges and no special configuration, but depends on human interaction from a victim - consistent with a reflected attack surface in the Panel Processor UI component. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Despite the 'Authentication Bypass' tag, the CVSS vector and impact scope indicate this is a partial, integrity-and-confidentiality-affecting client-side flaw rather than a full authentication bypass.
Cross-user attack in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 enables a low-privileged network attacker to compromise confidentiality and integrity of data across component boundaries when a victim user interacts with attacker-controlled content. The Security component is the attack surface, consistent with stored or reflected client-side injection (e.g., XSS) that hijacks session or data context of another user. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology component) allows a high-privileged attacker with HTTP network access to read critical or all accessible PeopleSoft data. Affecting supported versions 8.61 and 8.62, Oracle classifies this as easily exploitable despite the PR:H requirement, yielding a CVSS 3.1 score of 4.9 with confidentiality-only impact. No public exploit code and no CISA KEV listing exist at time of analysis; however, the 'Authentication Bypass' tag in the advisory metadata warrants attention in environments with multiple admin-tier users.
Cross-boundary exploitation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of data - including in additional downstream PeopleSoft products - by inducing a victim user to perform an action via HTTP. The CVSS scope-change indicator (S:C) and required user interaction (UI:R) are characteristic of a client-side injection class (e.g., stored or reflected XSS within the Security component) that crosses trust boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cross-site scripting or client-side injection in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools 8.62 permits a low-privileged, authenticated network attacker to compromise confidentiality and integrity of accessible PeopleTools data - and, due to a scope change, potentially additional Oracle products - when a victim user interacts with attacker-controlled content. The attack vector is HTTP, requires no elevated complexity, and is classified as easily exploitable. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the Critical Patch Update for July 2026.
Improper access control in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of accessible data when a victim user interacts with attacker-controlled content. The scope change (S:C) in the CVSS vector indicates successful exploitation can impact resources beyond the vulnerable component, consistent with client-side attack patterns such as stored or reflected XSS enabling cross-context data access. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), indicating negligible observed exploitation pressure at time of analysis.
Improper access control in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a high-privileged network attacker to perform unauthorized data reads, writes, and partial denial-of-service with scope change affecting adjacent PeopleSoft products. Despite a network-accessible attack vector and no user interaction required, exploitation is gated by the requirement for high-privilege credentials, and SSVC signals (exploitation: none, automatable: no) confirm no active exploitation at time of analysis. Oracle disclosed this through its April 2026 Critical Patch Update; no public exploit code has been identified.
Improper access control (CWE-284) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 permits unauthenticated remote attackers to perform unauthorized data reads and writes against PeopleTools and connected downstream products, contingent on luring an authenticated user into triggering the vulnerable endpoint via HTTP. The CVSS vector pattern (AV:N/PR:N/UI:R/S:C) combined with the Authentication Bypass tag strongly suggests a client-side injection vector such as reflected XSS or CSRF that operates within the victim's session context. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (8th percentile) and SSVC Exploitation:none corroborate the absence of observed active exploitation at time of analysis.
Peoplesoft Enterprise Peopletools versions up to 8.60 is affected by cross-site scripting (xss) (CVSS 6.1).
Peoplesoft Enterprise Peopletools versions up to 8.60 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise Pe (CVSS 6.1).
Peoplesoft Enterprise Peopletools versions up to 8.60 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise Pe (CVSS 5.4).
Authenticated information disclosure in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 allows a low-privileged attacker with network access to the Query component to read a subset of accessible data. Exploitation requires valid credentials and no user interaction, and the impact is limited to confidentiality; no public exploit code or active exploitation has been identified at the time of analysis. The EPSS score is 0.29%, indicating a low likelihood of exploitation, and this is assessed as a low-to-moderate priority issue.
PeopleSoft PeopleTools versions 8.60, 8.61, and 8.62 contain an out-of-bounds read vulnerability (CWE-125) in the PIA Core Technology component that allows unauthenticated remote attackers to read and modify limited data, provided they can convince a user to interact with a crafted HTTP request. The attack requires user interaction (UI:R) but no authentication (PR:N), and while no public exploit code is identified at time of analysis, the EPSS score is 0.25% (15th percentile), indicating low predicted exploitation activity. This moderate-severity issue (CVSS 5.4) is unlikely to be a top patching priority despite affecting a high-value enterprise ERP platform.
An out-of-bounds read in the PIA Core Technology component of Oracle PeopleSoft Enterprise PeopleTools 8.60, 8.61, and 8.62 allows a low-privileged authenticated attacker with HTTP network access to read a subset of application data and perform unauthorized updates, inserts, or deletes, provided a separate victim user is induced to interact with attacker-supplied content. The scope-change rating means effects can extend beyond PeopleTools into other connected products, although availability is not impacted, keeping this a moderate-severity, moderate-priority issue rather than an emergency. No public exploit code or active exploitation has been identified at time of analysis, and EPSS estimates only a 0.22 percent probability of exploitation in the next 30 days (12th percentile).
Improper access control (CWE-284) in Oracle PeopleSoft Enterprise PeopleTools versions 8.60, 8.61, and 8.62 lets an attacker who already holds high privileges in the product reach the PIA Core Technology web interface over HTTP and read a limited subset of data as well as insert, update, or delete some data, with the impact potentially extending to other, linked products because the flaw causes a scope change. The CVSS 3.1 base score is 5.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N), and the PR:H prerequisite is the main limiting factor: only malicious insiders or attackers who have already compromised a privileged PeopleSoft account can realistically exploit it, while no user interaction is required. There is no public exploit identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and EPSS is low at 0.25% (15th percentile), so risk is best characterized as moderate and tied to privileged-account hygiene rather than external mass exploitation.
Information disclosure in Oracle PeopleSoft Enterprise PeopleTools 8.60, 8.61, and 8.62 allows a high-privileged, authenticated attacker with network HTTP access to read critical data through the OpenSearch Dashboards component, potentially exposing all PeopleTools-accessible data. Successful exploitation depends on the vulnerable Dashboards component being enabled and reachable, and requires a privileged PeopleTools account - a precondition that confines realistic risk to malicious insiders or attackers who have already compromised a privileged account. No public exploit code has been identified at time of analysis (EPSS 0.37%, percentile 29%; not listed in CISA KEV), and Oracle has published fixes in its October 2025 Critical Patch Update.
Unauthorized data read and modification in Oracle PeopleSoft PeopleTools 8.60, 8.61 and 8.62 is reachable over the network by an unauthenticated attacker, but only after a legitimate PeopleSoft user is persuaded to interact with crafted content delivered through the PeopleSoft Internet Architecture (PIA) HTTP interface (CVSS 3.1 base 6.1). Successful exploitation yields read access to a subset of data plus insert, update or delete access to some accessible data, and because the vulnerable component feeds content into a downstream product the scope changes to Changed, while confidentiality and integrity impacts remain Low. Mandatory user interaction (UI:R) prevents autonomous, high-volume abuse, EPSS places exploitation likelihood at about 0.25% (15th percentile), and no public exploit code has been identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Unauthenticated HTTP requests directed at the Performance Monitor component of Oracle PeopleSoft Enterprise PeopleTools 8.60, 8.61, and 8.62 can drive uncontrolled resource consumption that hangs or repeatedly crashes the application, producing a complete denial of service. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed and only network reachability to the exposed Performance Monitor endpoint is required, making any internet- or intranet-facing instance of the affected versions a realistic target. Impact is confined strictly to availability (no confidentiality or integrity loss). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS is low at 0.43% (35th percentile), so exploitation is opportunistic rather than observed in the wild. A fix is available through Oracle's October 2025 Critical Patch Update.
An out-of-bounds read (CWE-125) in the Rich Text Editor component of Oracle PeopleSoft Enterprise PeopleTools 8.60, 8.61, and 8.62 lets a low-privileged attacker with a valid PeopleSoft account and network access submit crafted rich-text content that, once rendered by a second user, can expose a subset of PeopleTools-accessible data and permit unauthorized update, insert, or delete operations on it. Exploitation is gated by two independent prerequisites - a valid low-privileged account (PR:L) and interaction from a different human victim (UI:R) - and the scope change (S:C) means impact can extend to products integrated with PeopleTools beyond the editor itself. There is no public exploit code and no confirmed active exploitation (CISA KEV does not list this CVE), and EPSS is low at 0.22% (12th percentile), making this a moderate-severity, low-priority item appropriate for routine Oracle Critical Patch Update handling.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XMLPublisher). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Rich Text Editor). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).4.30 to 2.4.48 (inclusive). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Malformed requests may cause the server to dereference a NULL pointer.4.48 and earlier. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
jsoup is a Java library for working with HTML. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ckeditor is an open source WYSIWYG HTML editor with rich content support. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 expose an exploitable flaw in the SQR component that lets a low-privileged, authenticated user reach the service over HTTP and read data well beyond their intended authorization while also crashing or repeatedly hanging the application. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) the attacker needs a valid account but no elevated role and no victim interaction, and the confidentiality impact is rated total for data accessible through PeopleTools, with a matching high availability impact from the resulting denial of service. Oracle rates this 8.1 and released it in its Critical Security Patch Update cycle; no EPSS score, CISA KEV listing, or public exploit code was supplied with the source data at time of analysis.
Local, low-privileged compromise of the SQR component in Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets an attacker who already holds a logon to the host where PeopleTools runs take full control of the PeopleTools instance, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). The flaw is rated easily exploitable once host access exists (AC:L, PR:L, UI:N), but the AV:L vector means it is not remotely reachable from the network without some foothold on the target infrastructure. The provided intelligence contains no EPSS score, no CISA KEV listing and no public exploit reference, so no public exploit was identified at time of analysis, though the code-execution outcome makes this a high-value post-compromise escalation path.
Low-privileged attackers with network access to the HTTP interface of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Report Distribution component to achieve full takeover of the PeopleTools application, with high impact to confidentiality, integrity, and availability. Oracle rates the issue 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), characterizing it as easily exploitable because it needs only a basic authenticated account and no user interaction. No public proof-of-concept or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can be fully taken over through a flaw in its SQR component, but only by an attacker who already holds a high-privileged logon on the host where PeopleTools runs and who can persuade another user to perform an interaction. Oracle rates it 7.2 because a successful attack is difficult to execute yet delivers complete loss of confidentiality, integrity and availability, and because the compromise can spill over into connected products (scope change). No public exploit code is identified and there is no CISA KEV entry, so the issue is a defensive hardening priority rather than an observed campaign.
Local takeover of Oracle PeopleSoft Enterprise PeopleTools (Cube Manager component) is possible for a low-privileged user who can log on to the infrastructure hosting the product, affecting versions 8.61 through 8.63. Oracle scores this 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a difficult-to-exploit but fully compromising flaw that yields high confidentiality, integrity and availability impact on the PeopleTools instance itself. No public exploit code or CISA KEV listing was identified at time of analysis, so the immediate threat is limited to actors who already hold a valid low-privileged account and interactive access to the PeopleSoft application tier.
A low-privileged, authenticated attacker with HTTP network access can exploit the Cube Manager component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to modify or delete critical data and to repeatedly crash or hang the application, producing a complete denial of service. Oracle rates the flaw 8.1 on the CVSS 3.1 scale with high integrity and availability impact but no confidentiality impact, and the vulnerability requires an existing valid account rather than being exploitable pre-authentication. No public proof-of-concept code or evidence of active exploitation was present in the supplied intelligence at the time of analysis.
PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 contain an authentication bypass in the Security component, exploitable by a low-privileged attacker with local infrastructure access to achieve full confidentiality and integrity compromise of PeopleTools data, with scope change enabling lateral impact across additional integrated Oracle products. The local attack vector (AV:L) and high complexity (AC:H) constrain exploitation to insider threats or post-compromise scenarios, but the S:C scope change and H/H confidentiality-integrity impact make successful exploitation highly consequential in large Oracle ERP environments. No public exploit code or active exploitation has been identified at time of analysis.
Full takeover of Oracle PeopleSoft Enterprise PeopleTools is achievable by an unauthenticated remote attacker targeting the nVision component via HTTP on versions 8.61 through 8.63. The attack requires that a victim user interact with attacker-controlled content - consistent with a client-side exploitation pattern such as XSS or CSRF - after which the attacker achieves complete compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and absence of any authentication requirement lower the bar for targeted exploitation against internet-accessible PeopleSoft deployments.
Local privilege escalation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 enables a low-privileged attacker with infrastructure logon access to achieve full system takeover via the Tuxedo middleware component. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires physical or session-level access to the host and involves high attack complexity, materially limiting opportunistic exploitation despite the complete CIA impact. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via its August 2026 Critical Security Patch Update.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) is achievable by a network-accessible, highly privileged attacker via a flaw in the PeopleCode component over HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - Oracle characterizes the outcome as a full 'takeover' of the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, and the PR:H requirement narrows the realistic attacker population to those already holding administrative-level credentials.
SQL-based exploitation in Oracle PeopleSoft Enterprise PeopleTools Configuration Manager (versions 8.61-8.63) enables a low-privileged authenticated attacker to achieve full system takeover over the network. The vulnerability is rated CVSS 8.8 High with complete Confidentiality, Integrity, and Availability impacts, and Oracle's own description characterizes it as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad enterprise deployment footprint make this a credible priority for organizations running affected PeopleTools versions.
Local code execution and data compromise in Oracle PeopleSoft Enterprise PeopleTools (Data Mover component) affects versions 8.61 through 8.63, requiring a highly privileged attacker with physical or logical infrastructure access and human interaction from a secondary party. Successful exploitation results in full confidentiality and integrity compromise of PeopleTools data, potential modification or deletion of critical records, and partial denial of service, with a confirmed scope change that can cascade impact to additional dependent PeopleSoft products. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Oracle CSPU August 2026 advisory confirms this as a patched, vendor-acknowledged vulnerability.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools (Install and Packaging component) versions 8.61 through 8.63 exposes critical HR and ERP data to unauthenticated network attackers over HTTP. Successful exploitation grants complete confidentiality and integrity compromise of all PeopleSoft-accessible data, including unauthorized creation, deletion, and modification of critical records. No public exploit has been identified at time of analysis, and CVSS AC:H rating indicates meaningful exploitation complexity, but the absence of any authentication requirement elevates organizational urgency.
Full system takeover is achievable against Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 via an unauthenticated HTTP attack targeting the Integration Broker component. The vulnerability carries a CVSS 3.1 score of 8.1 with complete confidentiality, integrity, and availability impact, though the AC:H metric indicates exploitation is not trivial and requires meeting specific attack complexity conditions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack path and full-takeover impact class make this a high-priority patching candidate for organizations running affected PeopleTools versions.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible via the Business Interlink component, where a remote unauthenticated attacker sending crafted HTTP requests can take over the product. Oracle rates this at CVSS 9.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch in the August 2026 Critical Patch Update.
Complete system takeover of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) is achievable by unauthenticated network attackers via HTTP, specifically through the PIA Core Technology component. Despite the high attack complexity rating (AC:H), successful exploitation yields full confidentiality, integrity, and availability compromise - effectively handing an attacker control over the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the impact warrants prioritized remediation through Oracle's August 2026 Critical Patch Update.
Unauthorized access to critical data in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible via the bundled OpenSearch Dashboards component, where a remote unauthenticated attacker can compromise confidentiality by luring a victim into interacting with attacker-supplied content (UI:R). The scope-change and confidentiality-only vector (S:C/C:H/I:N/A:N), combined with the vendor's 'Authentication Bypass' tag, is characteristic of a client-side flaw such as cross-site scripting in the Dashboards UI that lets an attacker read data across products the victim can reach. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 (Process Scheduler component) lets a low-privileged, network-reachable attacker read and modify critical data after luring a legitimate user into an interaction, with a scope change that can spill impact onto additional connected products. Oracle rates it CVSS 3.1 8.7 (C:H/I:H, no availability impact). No public exploit is identified at time of analysis and it is not in CISA KEV, but ease of exploitation and the cross-boundary scope change make it a notable item in the July 2026 Oracle Critical Patch Update.
Cross-site-scripting-style compromise of Oracle PeopleSoft Enterprise PeopleTools 8.62 (PIA Core Technology) lets a remote, unauthenticated attacker who lures an authenticated user into interacting with a crafted HTTP request achieve limited read/write access to PeopleSoft data and cause partial denial of service. The scope-change flag (S:C) means the impact can extend beyond PeopleTools into additional integrated products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS 3.1 base score is 7.1.
Remote takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible through the Updates Environment Management component via unauthenticated HTTP requests. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation against any internet- or intranet-exposed instance, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' language and the unauthenticated nature make this a high-priority patching target.
Broad data compromise in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.62 allows a low-privileged, network-adjacent attacker to reach any data the platform can access. The flaw sits in the Security component and is characterized by improper access control (CWE-284, tagged as Authentication Bypass), letting an authenticated-but-unprivileged user read, create, delete, or modify critical data across the deployment. There is no public exploit identified at time of analysis, EPSS risk is very low (0.03%), and it is not on CISA KEV.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthorized data access in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 allows a low-privileged, authenticated network attacker to read a subset of PeopleTools data and perform unauthorized insert, update, or delete operations via the Panel Processor component, with a confirmed scope change meaning successful exploitation can extend impact to additional dependent products. The attack carries high complexity and requires human interaction from a third-party victim. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though Oracle's tagging of 'Authentication Bypass' suggests the Panel Processor may allow privilege escalation beyond what the attacker's credential level should permit.
Cross-site or client-side injection in Oracle PeopleSoft Enterprise PeopleTools Panel Processor (versions 8.61 and 8.62) enables unauthenticated remote attackers to achieve limited unauthorized data read and write access by luring an authenticated user into interacting with a crafted HTTP request. The attack requires no privileges and no special configuration, but depends on human interaction from a victim - consistent with a reflected attack surface in the Panel Processor UI component. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Despite the 'Authentication Bypass' tag, the CVSS vector and impact scope indicate this is a partial, integrity-and-confidentiality-affecting client-side flaw rather than a full authentication bypass.
Cross-user attack in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 enables a low-privileged network attacker to compromise confidentiality and integrity of data across component boundaries when a victim user interacts with attacker-controlled content. The Security component is the attack surface, consistent with stored or reflected client-side injection (e.g., XSS) that hijacks session or data context of another user. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise PeopleTools (PIA Core Technology component) allows a high-privileged attacker with HTTP network access to read critical or all accessible PeopleSoft data. Affecting supported versions 8.61 and 8.62, Oracle classifies this as easily exploitable despite the PR:H requirement, yielding a CVSS 3.1 score of 4.9 with confidentiality-only impact. No public exploit code and no CISA KEV listing exist at time of analysis; however, the 'Authentication Bypass' tag in the advisory metadata warrants attention in environments with multiple admin-tier users.
Cross-boundary exploitation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of data - including in additional downstream PeopleSoft products - by inducing a victim user to perform an action via HTTP. The CVSS scope-change indicator (S:C) and required user interaction (UI:R) are characteristic of a client-side injection class (e.g., stored or reflected XSS within the Security component) that crosses trust boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cross-site scripting or client-side injection in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools 8.62 permits a low-privileged, authenticated network attacker to compromise confidentiality and integrity of accessible PeopleTools data - and, due to a scope change, potentially additional Oracle products - when a victim user interacts with attacker-controlled content. The attack vector is HTTP, requires no elevated complexity, and is classified as easily exploitable. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the Critical Patch Update for July 2026.
Improper access control in the Workflow component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of accessible data when a victim user interacts with attacker-controlled content. The scope change (S:C) in the CVSS vector indicates successful exploitation can impact resources beyond the vulnerable component, consistent with client-side attack patterns such as stored or reflected XSS enabling cross-context data access. No public exploit code has been identified and EPSS sits at 0.03% (8th percentile), indicating negligible observed exploitation pressure at time of analysis.
Improper access control in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a high-privileged network attacker to perform unauthorized data reads, writes, and partial denial-of-service with scope change affecting adjacent PeopleSoft products. Despite a network-accessible attack vector and no user interaction required, exploitation is gated by the requirement for high-privilege credentials, and SSVC signals (exploitation: none, automatable: no) confirm no active exploitation at time of analysis. Oracle disclosed this through its April 2026 Critical Patch Update; no public exploit code has been identified.
Improper access control (CWE-284) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 permits unauthenticated remote attackers to perform unauthorized data reads and writes against PeopleTools and connected downstream products, contingent on luring an authenticated user into triggering the vulnerable endpoint via HTTP. The CVSS vector pattern (AV:N/PR:N/UI:R/S:C) combined with the Authentication Bypass tag strongly suggests a client-side injection vector such as reflected XSS or CSRF that operates within the victim's session context. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS of 0.03% (8th percentile) and SSVC Exploitation:none corroborate the absence of observed active exploitation at time of analysis.
Peoplesoft Enterprise Peopletools versions up to 8.60 is affected by cross-site scripting (xss) (CVSS 6.1).
Peoplesoft Enterprise Peopletools versions up to 8.60 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise Pe (CVSS 6.1).
Peoplesoft Enterprise Peopletools versions up to 8.60 contains a vulnerability that allows attackers to unauthorized update, insert or delete access to some of PeopleSoft Enterprise Pe (CVSS 5.4).
Authenticated information disclosure in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 allows a low-privileged attacker with network access to the Query component to read a subset of accessible data. Exploitation requires valid credentials and no user interaction, and the impact is limited to confidentiality; no public exploit code or active exploitation has been identified at the time of analysis. The EPSS score is 0.29%, indicating a low likelihood of exploitation, and this is assessed as a low-to-moderate priority issue.
PeopleSoft PeopleTools versions 8.60, 8.61, and 8.62 contain an out-of-bounds read vulnerability (CWE-125) in the PIA Core Technology component that allows unauthenticated remote attackers to read and modify limited data, provided they can convince a user to interact with a crafted HTTP request. The attack requires user interaction (UI:R) but no authentication (PR:N), and while no public exploit code is identified at time of analysis, the EPSS score is 0.25% (15th percentile), indicating low predicted exploitation activity. This moderate-severity issue (CVSS 5.4) is unlikely to be a top patching priority despite affecting a high-value enterprise ERP platform.
An out-of-bounds read in the PIA Core Technology component of Oracle PeopleSoft Enterprise PeopleTools 8.60, 8.61, and 8.62 allows a low-privileged authenticated attacker with HTTP network access to read a subset of application data and perform unauthorized updates, inserts, or deletes, provided a separate victim user is induced to interact with attacker-supplied content. The scope-change rating means effects can extend beyond PeopleTools into other connected products, although availability is not impacted, keeping this a moderate-severity, moderate-priority issue rather than an emergency. No public exploit code or active exploitation has been identified at time of analysis, and EPSS estimates only a 0.22 percent probability of exploitation in the next 30 days (12th percentile).
Improper access control (CWE-284) in Oracle PeopleSoft Enterprise PeopleTools versions 8.60, 8.61, and 8.62 lets an attacker who already holds high privileges in the product reach the PIA Core Technology web interface over HTTP and read a limited subset of data as well as insert, update, or delete some data, with the impact potentially extending to other, linked products because the flaw causes a scope change. The CVSS 3.1 base score is 5.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N), and the PR:H prerequisite is the main limiting factor: only malicious insiders or attackers who have already compromised a privileged PeopleSoft account can realistically exploit it, while no user interaction is required. There is no public exploit identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and EPSS is low at 0.25% (15th percentile), so risk is best characterized as moderate and tied to privileged-account hygiene rather than external mass exploitation.
Information disclosure in Oracle PeopleSoft Enterprise PeopleTools 8.60, 8.61, and 8.62 allows a high-privileged, authenticated attacker with network HTTP access to read critical data through the OpenSearch Dashboards component, potentially exposing all PeopleTools-accessible data. Successful exploitation depends on the vulnerable Dashboards component being enabled and reachable, and requires a privileged PeopleTools account - a precondition that confines realistic risk to malicious insiders or attackers who have already compromised a privileged account. No public exploit code has been identified at time of analysis (EPSS 0.37%, percentile 29%; not listed in CISA KEV), and Oracle has published fixes in its October 2025 Critical Patch Update.
Unauthorized data read and modification in Oracle PeopleSoft PeopleTools 8.60, 8.61 and 8.62 is reachable over the network by an unauthenticated attacker, but only after a legitimate PeopleSoft user is persuaded to interact with crafted content delivered through the PeopleSoft Internet Architecture (PIA) HTTP interface (CVSS 3.1 base 6.1). Successful exploitation yields read access to a subset of data plus insert, update or delete access to some accessible data, and because the vulnerable component feeds content into a downstream product the scope changes to Changed, while confidentiality and integrity impacts remain Low. Mandatory user interaction (UI:R) prevents autonomous, high-volume abuse, EPSS places exploitation likelihood at about 0.25% (15th percentile), and no public exploit code has been identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Unauthenticated HTTP requests directed at the Performance Monitor component of Oracle PeopleSoft Enterprise PeopleTools 8.60, 8.61, and 8.62 can drive uncontrolled resource consumption that hangs or repeatedly crashes the application, producing a complete denial of service. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed and only network reachability to the exposed Performance Monitor endpoint is required, making any internet- or intranet-facing instance of the affected versions a realistic target. Impact is confined strictly to availability (no confidentiality or integrity loss). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; EPSS is low at 0.43% (35th percentile), so exploitation is opportunistic rather than observed in the wild. A fix is available through Oracle's October 2025 Critical Patch Update.
An out-of-bounds read (CWE-125) in the Rich Text Editor component of Oracle PeopleSoft Enterprise PeopleTools 8.60, 8.61, and 8.62 lets a low-privileged attacker with a valid PeopleSoft account and network access submit crafted rich-text content that, once rendered by a second user, can expose a subset of PeopleTools-accessible data and permit unauthorized update, insert, or delete operations on it. Exploitation is gated by two independent prerequisites - a valid low-privileged account (PR:L) and interaction from a different human victim (UI:R) - and the scope change (S:C) means impact can extend to products integrated with PeopleTools beyond the editor itself. There is no public exploit code and no confirmed active exploitation (CISA KEV does not list this CVE), and EPSS is low at 0.22% (12th percentile), making this a moderate-severity, low-priority item appropriate for routine Oracle Critical Patch Update handling.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XMLPublisher). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Navigation Pages, Portal, Query). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups.
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
CKEditor4 is an open source WYSIWYG HTML editor. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
jQuery-UI is the official jQuery user interface library. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Rich Text Editor). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).4.30 to 2.4.48 (inclusive). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
Malformed requests may cause the server to dereference a NULL pointer.4.48 and earlier. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
jsoup is a Java library for working with HTML. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
ckeditor is an open source WYSIWYG HTML editor with rich content support. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.