CVE-2022-21587-Oracle-EBS-

🗓️ 24 Aug 2026 14:41:44Reported by KitPloitType

kitploit🔗 kitploit.com👁 1 Views

Command injection in Oracle EBS via cmd header in FNDWRR.exe CGI endpoint enables RCE.

Reporter	Title	Published	Views	Family All 34
zdt	Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload Exploit	2 Mar 202300:00	–	zdt
GithubExploit	Exploit for Missing Authentication for Critical Function in Oracle E-Business_Suite	6 Feb 202304:18	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Oracle E-Business_Suite	6 Feb 202304:18	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Oracle E-Business_Suite	3 Mar 202312:56	–	githubexploit
ICS	CISA Red Team’s Operations Against a Federal Civilian Executive Branch Organization Highlights the Necessity of Defense-in-Depth	11 Jul 202412:00	–	ics
ATTACKERKB	CVE-2022-21587	18 Oct 202200:00	–	attackerkb
BDU FSTEC	The vulnerability of the Upload component of the software environment for working with Oracle Web Applications desktop integrations allows a hacker to gain full control over the application.	6 Feb 202300:00	–	bdu_fstec
Circl	CVE-2022-21587	19 Oct 202200:14	–	circl
CISA KEV Catalog	Oracle E-Business Suite Unspecified Vulnerability	2 Feb 202300:00	–	cisa_kev
CNNVD	Oracle E-Business Suite 访问控制错误漏洞	18 Oct 202200:00	–	cnnvd

Source	Link
github	www.github.com/usdAG/slipit

24 Aug 2026 14:41Current

CVSS 3.19.8

EPSS0.98342

SSVC

Oracle EBS command injection header injection FNDWRR.exe CGI endpoint remote code execution