Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB)…
Priority LOW 37Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwv_flow_security.check_db_password function due to insufficient checks for '"' characters.
Why it matters now
EPSS 0.01952 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2007-3860
- 2026-10-03 Alias added: GHSA-jqq8-884r-26cj
References
Advisory 3
Other 6
- http://www.red-database-security.com/advisory/oracle_apex_sql_injection_check_db_password.html
- http://www.oracle.com/technetwork/topics/security/cpujul2007-087014.html
- ADV-2007-2562
- ADV-2007-2635
- http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf
- http://www.red-database-security.com/advisory/oracle_cpu_jul_2007.html
More Oracle Apex vulnerabilities
- TI-2006-05164 Multiple unspecified vulnerabilities in Oracle Application Express 1.5 up to 1.6.1 have… CVSS 2.0HIGH 10.0
- TI-2006-05163 Multiple unspecified vulnerabilities in Oracle Application Express (formerly Oracle HTML… CVSS 2.0HIGH 9.0
- TI-2026-42857 Information disclosure in Oracle APEX CVSS 3.1MEDIUM 5.3
- TI-2007-03738 Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5… CVSS 2.0MEDIUM 5.5
- TI-2006-06879 SQL injection vulnerability in wwv_flow_utilities.gen_popup_list in the… CVSS 2.0MEDIUM 6.0
- TI-2026-43295 Improper access control in Oracle APEX CVSS 3.1MEDIUM 5.5
Sources
- CVE-2007-3860 · CVE Program
- CVE-2007-3860 · NVD
- FIRST EPSS
- GHSA-jqq8-884r-26cj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences