CVE-2017-3528

CVE-2017-3528 affects Oracle E-Business Suite (Oracle Applications Framework, Popup windows) with open redirect in 12.1.3 and 12.2.x (up to 12.2.6). Exploitation requires unauthenticated HTTP access and user interaction; the redirect parameter can point to an attacker-controlled domain, enabling ...

CVE-2022-21468

CVE-2022-21468 affects Oracle E-Business Suite’s Oracle Applications Framework (OA Framework), specifically the Popups component. Affected versions are 12.2.4–12.2.11 . The vulnerability allows an unauthenticated attacker to compromise OA Framework via HTTP with network access; exploitation requi...

CVE-2022-21477

CVE-2022-21477 affects Oracle E-Business Suite’s Oracle Applications Framework (Attachments, File Upload). Affected versions are 12.2.6–12.2.11. The issue allows a low-privilege, network-accessible attacker over HTTP to compromise the framework; successful attacks require user interaction and may...

CVE-2021-2477

CVE-2021-2477 affects Oracle E-Business Suite, Oracle Applications Framework (Session Management). Affected: 12.1.3 and 12.2.3–12.2.10. An unauthenticated, network-accessible attacker over HTTP can cause partial denial of service to the framework. CVSS v3.1 base 5.3 (A). Documents corroborate; no...

CVE-2021-2200

CVE-2021-2200 affects Oracle E-Business Suite, specifically the Oracle Applications Framework Home page in version 12.2.10. The vulnerability is described as easily exploitable via unauthenticated HTTP access, enabling an attacker to compromise the Oracle Applications Framework and potentially pe...

CVE-2022-21636

CVE-2022-21636 affects Oracle E-Business Suite’s Oracle Applications Framework (Session Management). Across multiple sources, affected versions are 12.2.6–12.2.11. The vulnerability allows a low-privilege, network-accessible attacker (via HTTP) to access or potentially exfiltrate data within Orac...

CVE-2022-21566

CVE-2022-21566 affects Oracle E-Business Suite, specifically the Oracle Applications Framework Diagnostics component. Affected versions are 12.2.9–12.2.11. It allows unauthenticated, network-based access via HTTP, risking unauthorized data access within Oracle Applications Framework. MITRE/ATT&CK...

CVE-2021-2380

CVE-2021-2380 affects Oracle E-Business Suite, specifically the Oracle Applications Framework (Attachments / File Upload). Affected are EBS versions 12.1.3 and 12.2.3-12.2.10. The vulnerability allows a low-privileged, network-accessible attacker (via HTTP) to compromise the Oracle Applications F...

CVE-2023-22042

CVE-2023-22042 affects Oracle E-Business Suite, specifically the Diagnostics component of Oracle Applications Framework. Affected versions are 12.2.3–12.3.12. The issue allows an unauthenticated attacker with network access via HTTP to compromise the framework, with human interaction required, po...

CVE-2024-21080

CVE-2024-21080: In Oracle E-Business Suite, the Oracle Applications Framework REST Services have a vulnerability due to insufficient input validation. Affects 12.2.9–12.2.13; an attacker with network access over HTTP and low privileges can potentially access confidential data or data within the R...

CVE-2025-30718

CVE-2025-30718 affects Oracle E-Business Suite, Oracle Applications Framework, specifically the Attachments/File Upload component. Affected versions are 12.2.3–12.2.14. The issue allows a low-privileged, network-accessible attacker (HTTP) to read and modify Oracle Applications Framework data, pot...

CVE-2018-2971

CVE-2018-2971 affects Oracle E-Business Suite’s Applications Framework (OA Framework) REST Services. Affected versions: 12.1.3, 12.2.3–12.2.7. Vulnerability allows low-privilege, network-access attacker (HTTP) to read a subset of OA Framework data. CVSSv3 base score 4.3 (Confidentiality impact: L...

CVE-2018-3243

CVE-2018-3243 affects Oracle E-Business Suite OA Framework. Affected versions are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6. The vulnerability allows unauthenticated remote access via HTTP to Oracle Applications Framework, with human interaction required for exploitation, potentially leading to unau...

CVE-2020-14590

CVE-2020-14590 is a vulnerability in Oracle E-Business Suite’s Oracle Applications Framework (OA Framework), specifically the Page Request component. Affected versions are 12.1.3 and 12.2.3–12.2.9. The issue allows a high-privilege attacker with network access over HTTP to read a subset of OA Fra...

CVE-2025-30711

CVE-2025-30711 affects Oracle E-Business Suite, Oracle Applications Framework (Attachments, File Upload). Affected: 12.2.3–12.2.14. Vulnerability allows a low-privileged attacker with network access via HTTP to compromise the framework, with human interaction required. Impact per sources: unautho...

CVE-2019-2682

CVE-2019-2682 affects Oracle E-Business Suite Applications Framework (OA Framework) with the Attachments / File Upload subcomponent. Affected versions: 12.1.3, 12.2.3–12.2.8. Description: unauthenticated attacker with network access over HTTP can compromise OA Framework; attacks require human int...

CVE-2020-14746

CVE-2020-14746 affects Oracle E-Business Suite, Oracle Applications Framework (Popup windows). Vulnerable versions: 12.1.3 and 12.2.3–12.2.10. An unauthenticated attacker with network access over HTTP can exploit this, with user interaction required, to potentially perform unauthorized updates, i...

CVE-2020-2666

CVE-2020-2666 affects Oracle E-Business Suite, Oracle Applications Framework within the Attachments/File Upload component. Affects 12.2.5–12.2.9 and can be exploited by an unauthenticated remote attacker over HTTPS to cause unauthorized update/insert/delete of Oracle Applications Framework data. ...

CVE-2020-2890

The CVE-2020-2890 entry concerns Oracle E-Business Suite’s Oracle Applications Framework (Diagnostics). Affected are 12.1.3 and 12.2.3–12.2.9. The flaw allows an unauthenticated remote attacker, over HTTP, to compromise the Oracle Applications Framework. Attacks require human interaction and can ...

CVE-2020-2866

CVE-2020-2866 affects Oracle E-Business Suite, Oracle Applications Framework (Attachments / File Upload). Affected versions are 12.2.5–12.2.9. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise the framework, potentially enabling unauthorized update/i...

CVE-2016-3447

CVE-2016-3447 affects Oracle E-Business Suite OA Framework (OAF Core) across 12.1.3, 12.2.3, 12.2.4, and 12.2.5. The vulnerability is described as unspecified in OAF Core that could be exploited remotely to affect confidentiality and integrity. Connected documents confirm OAF Core is the vulnerab...

CVE-2020-2566

CVE-2020-2566 affects Oracle E-Business Suite’s Oracle Applications Framework (Attachments / File Upload). Affected versions are 12.1.3 and 12.2.3–12.2.9. The flaw resides in the Oracle Applications Framework component handling file uploads, enabling an unauthenticated attacker with network acces...

CVE-2020-14534

The CVE-2020-14534 entry concerns Oracle E-Business Suite’s OA Framework (Popups) in version 12.2.9. A vulnerability allows an unauthenticated attacker who can reach Oracle Applications Framework over HTTP to compromise it, with human interaction required. The impact described includes potential ...

CVE-2020-14610

The CVE-2020-14610 entry describes a vulnerability in Oracle E-Business Suite’s Oracle Applications Framework (OA Framework), specifically in the Attachments / File Upload component. Affected product/version is Oracle E-Business Suite OA Framework with version 12.2.9. The flaw is exploitable over...

CVE-2026-60684

CVE-2026-60684 affects Oracle E-Business Suite’s Oracle Applications Framework (Upload Attachments) in versions 12.2.8–12.2.15. Reported risk: a low-privileged, network-accessible attacker can exploit via HTTP and, with user interaction, potentially update/insert/delete data and read data within ...

CVE-2025-50071

CVE-2025-50071 is a vulnerability in Oracle E-Business Suite, specifically Oracle Applications Framework (Web Utilities). Affected versions are 12.2.3–12.2.14. A low-privileged, network-accessible attacker (via HTTP) can compromise the framework, potentially enabling unauthorized update/insert/de...

CVE-2026-34298

CVE-2026-34298 affects Oracle Applications Framework within Oracle E-Business Suite, Personalization component. Affected: E-Business Suite versions 12.2.9–12.2.15. The vulnerability arises in the Personalization feature, enabling a high-privilege attacker with network access via HTTP to perform u...

CVE-2026-60676

The CVE affects Oracle E-Business Suite's Oracle Applications Framework (component: Search Bean). Affected versions are 12.2.3–12.2.15. The vulnerability allows a low-privileged attacker with network access over HTTP to compromise the Oracle Applications Framework, potentially leading to takeover...

CVE-2025-53064

Oracle E-Business Suite OA Framework Personalization is affected in versions 12.2.3–12.2.14. The vulnerability enables a low-privilege, unauthenticated attacker with HTTP access to cause unauthorized updates/inserts/deletes to OA Framework data. The Oct 2025 CPU advisories from Oracle (and NCSC/R...

CVE-2026-62546

CVE-2026-62546 affects Oracle E-Business Suite Oracle Applications Framework Web Utilities, with vulnerable versions 12.2.8–12.2.15. The issue enables a high-privilege attacker with network access via HTTP to compromise OAF, potentially taking over the Oracle Applications Framework. CVSS 3.1 base...

CVE-2026-60768

CVE-2026-60768 affects Oracle E-Business Suite, Oracle Applications Framework (OA Framework) Graph/Charting component. Affected are 12.2.3–12.2.15. An attacker with network access via HTTP and low privileges can compromise OA Framework, potentially causing unauthorized creation, deletion or modif...

CVE-2026-60774

Summary: CVE-2026-60774 is a vulnerability in Oracle Applications Framework (Oracle E-Business Suite), affecting 12.2.3 through 12.2.15. The flaw concerns the Search Bean (Incl. Advanced) component and can be exploited by a low-privileged attacker who can reach the system over HTTP to obtain unau...

CVE-2025-53071

CVE-2025-53071 affects Oracle E-Business Suite OA Framework Upload Attachments in versions 12.2.3–12.2.14. The vulnerability allows a low-privileged, network-accessing attacker over HTTP to cause unauthorized updates to OA Framework data. CVSS v3.1 base score 4.3 (I=L, A=N, C=N). No exploit detai...

CVE-2026-62534

CVE-2026-62534 affects Oracle E-Business Suite’s Oracle Applications Framework via the Web Utilities component. Affected versions are 12.2.11–12.2.15. The vulnerability is exploitable over HTTP with low privileges from the network and can lead to takeover of the Oracle Applications Framework. CVS...

CVE-2026-60675

CVE-2026-60675 affects Oracle E-Business Suite’s Oracle Applications Framework (OAF) – specifically the Search Bean component – in versions 12.2.3–12.2.15. The vulnerability enables a network-accessible, low-privilege attacker over HTTP to compromise OAF, potentially taking over the framework. CV...