CVE Feed

    Dashboard / CVE / CVE-2025-50067

    CVE-2025-50067

    Vulnerability in Oracle Application Express (component: Strategic Planner Starter App). Supported versions that are affected are 24.2.4 and 24.2.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Application Express. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

    Published:Jul 15, 2025
    Last Modified:Feb 26, 2026
    EPS:Jul 15, 2025
    EPSS Score:0.00086
    CVSS Score:9

    Affected Products

    Vendor
    Oracle
    Product
    Application Express

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-178 Cross-Site Flashing

    Related CVEs

    CVE-2025-21557 (CVSS 5.4) — Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23…
    CVE-2024-21261 (CVSS 4.9) — Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23…
    CVE-2023-21983 (CVSS 5.6) — Vulnerability in the Application Express Administration product of Oracle Application Express (component: None…
    CVE-2023-21975 (CVSS 9) — Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: Us…
    CVE-2023-21974 (CVSS 9) — Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component…
    CVE-2022-24729 (CVSS 6.5) — CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contai…
    CVE-2022-24728 (CVSS 5.4) — CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in t…
    CVE-2021-41165 (CVSS 8.2) — CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in th…
    CVE-2021-41164 (CVSS 8.2) — CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in t…
    CVE-2021-41182 (CVSS 6.5) — jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High