Oracle Apex vulnerabilities

10 CVEs affecting Oracle Apex, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-60630, published 2026-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2006-5352, published 2006-10-18. High severity, CVSS 10.0. EPSS: 2.9% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in Oracle Application Express 1.5 up to 1.6.1 have unknown impact and remote attack vectors, aka Vuln# (1) APEX04, (2) APEX20, and (3) APEX21.
CVE-2007-3854, published 2007-07-18. Medium severity, CVSS 5.5. EPSS: 2.5% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the Advanced Queuing…
CVE-2006-5351, published 2006-10-18. High severity, CVSS 9.0. EPSS: 2% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in Oracle Application Express (formerly Oracle HTML DB) 1.5 up to 2.0 have unknown impact and remote attack vectors, aka Vuln# (1) APEX01, (2) APEX02, (3) APEX03,…
CVE-2007-3860, published 2007-07-18. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. …
CVE-2006-5599, published 2006-10-28. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Oracle Application Express (formerly HTML DB) before 2.2.1 allows remote attackers to inject arbitrary HTML or web script via the WWV_FLOW_ITEM_HELP…
CVE-2006-7138, published 2007-03-07. Medium severity, CVSS 6.0. EPSS: 1.3% chance of exploitation in the next 30 days. SQL injection vulnerability in wwv_flow_utilities.gen_popup_list in the WWV_FLOW_UTILITIES package for Oracle APEX/HTMLDB before 2.2 allows remote authenticated users to execute arbitrary SQL by…
CVE-2006-7158, published 2007-03-07. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Oracle Application Express (APEX) before 2.2.1, aka Oracle HTML DB, allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATION_MSG…
CVE-2026-60156, published 2026-07-21. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1, 24.2 and 26.1. Easily exploitable vulnerability allows unauthenticated attacker with network access…
CVE-2026-21931, published 2026-01-20. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App). Supported versions that are affected are 23.2.0, 23.2.1, 24.1.0, 24.2.0 and 24.2.1.…
CVE-2026-60630, published 2026-07-21. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in Oracle APEX (component: Installation). Supported versions that are affected are 24.1, 24.2 and 26.1. Easily exploitable vulnerability allows low privileged attacker with logon to…