CVE-2025-61884

CVE-2025-61884 affects Oracle E-Business Suite Configurator Runtime UI (12.2.3–12.2.14). The vulnerability is an SSRF/unauthenticated access flaw in the Runtime UI that can disclose sensitive configuration data, with network access over HTTP required and no user interaction. Evidence and public m...

CVE-2022-21255

CVE-2022-21255 affects Oracle E-Business Suite Configurator (UI Servlet). Affected versions are 12.2.3–12.2.11. The vulnerability allows a network-accessible, low-privilege attacker to exploit via HTTP to compromise data, enabling unauthorized creation/deletion/modification of Oracle Configurator...

CVE-2025-30728

The CVE-2025-30728 vulnerability affects Oracle E-Business Suite, specifically the Oracle Configurator (Core) in versions 12.2.3–12.2.14. The issue enables an unauthenticated attacker with network access over HTTP to access Oracle Configurator data, with impacts described as unauthorized data acc...

CVE-2019-2567

CVE-2019-2567 affects Oracle Configurator (Active Model Generation) in Oracle Supply Chain Products Suite. Affected: 12.1 and 12.2. Issue: unauthenticated attacker over HTTP can gain unauthorized access to Oracle Configurator data. CVSSv3 base score 7.5 (High) with confidentiality impact. Connect...

CVE-2020-2865

CVE-2020-2865 affects the Oracle Configuretor (Oracle Supply Chain) — Installation component in Configurator versions 12.1 and 12.2. The issue allows an unauthenticated, network-accessible attacker via HTTP to read a subset of Confidential data. Root cause: insecure access to the Installation com...

CVE-2025-30720

The CVE-2025-30720 vulnerability affects Oracle E-Business Suite Oracle Configurator (Orders component) in versions 12.2.3–12.2.14. It allows an unauthenticated attacker with network access via HTTP to compromise Configurator, with attacks requiring user interaction and potentially impacting othe...

CVE-2021-2078

CVE-2021-2078 affects Oracle Configurator (UI Servlet) in Oracle Supply Chain. Affected versions are 12.1 and 12.2. The issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Configurator; exploitation requires user interaction. Base CVSS 3.1 score is 8.2 (Conf...

CVE-2021-2080

CVE-2021-2080 affects Oracle Configurator (UI Servlet) in Oracle Supply Chain, specifically versions 12.1 and 12.2. The vulnerability can be exploited remotely over HTTP by an unauthenticated attacker; however, successful attacks require human interaction. Impact includes unauthorized access to c...

CVE-2021-2079

CVE-2021-2079 affects Oracle Configurator (UI Servlet) in Oracle Supply Chain; impacted versions are 12.1 and 12.2. The issue enables network-accessible, unauthenticated access via HTTP, with user interaction required to exploit and potential for unauthorized data access and data modification. Ro...

CVE-2002-1640

Affected software: Oracle Configurator. Vulnerable versions: before 11.5.7.17.32 and 11.5.6.16.53. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML. Affected components: Text Features in the DHTML UI and the test parameter ...

CVE-2002-1639

Oracle Configurator prior to 11.5.7.17.32 and 11.5.6.16.53 is vulnerable to a remote information-disclosure via the oracle.apps.cz.servlet.UiServlet servlet when the test parameter is set to “version” or “host,” allowing access to sensitive information. The underlying issue is a server-side infor...

CVE-2016-3438

CVE-2016-3438 affects Oracle Supply Chain Products Suite — Configurator component (versions 12.0.6, 12.1, 12.2). Root cause cited as vulnerability in the JRAD Heartbeat subcomponent, allowing remote impact to confidentiality and integrity via unspecified vectors. Public descriptions also note pos...

CVE-2016-0540

Affected software: Oracle Supply Chain Products Suite — Configurator UI Servlet component. Vulnerability: an unspecified data access vulnerability allowing remote attackers to obtain sensitive information. Impact: unauthorized disclosure. Notes: connected CNVD entries describe the issue generical...

CVE-2020-14669

CVE-2020-14669 affects Oracle Configurator (UI Servlet) within Oracle Supply Chain. Affected versions: 12.1 and 12.2. The vulnerability is exploitable by an unauthenticated attacker with network access via HTTP; exploitation requires user interaction, and successful access could lead to unauthori...

CVE-2016-0541

CVE-2016-0541 affects Oracle Supply Chain Products Suite components: Oracle Configurator UI Servlet, with versions 11.5.10.2, 12.1, and 12.2. The issue is described as a data-access vulnerability that allows remote attackers to access sensitive data, compromising confidentiality via unknown vecto...

CVE-2026-21972

CVE-2026-21972 affects Oracle E-Business Suite, Oracle Configurator, User Interface component. Affected versions are 12.2.3–12.2.15. An unauthenticated attacker with network access via HTTP can compromise Oracle Configurator and obtain unauthorized read access to a subset of data. This is describ...

CVE-2026-34274

A vulnerability (CVE-2026-34274) affects Oracle Configurator in Oracle E-Business Suite, specifically the UI component, for versions 12.2.3–12.2.15. The issue allows an unauthenticated attacker with network access over HTTP to compromise Oracle Configurator, with user interaction required. The im...