Oracle Application Express vulnerabilities

47 CVEs affecting Oracle Application Express, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-50067, published 2025-07-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11023: JQuery Cross-Site Scripting (XSS) Vulnerability, published 2020-04-29. Medium severity, CVSS 6.1. Actively exploited: in CISA KEV since 2025-01-23. EPSS: 84.9% chance of exploitation in the next 30 days. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation…
CVE-2019-11358, published 2019-04-20. Medium severity, CVSS 6.1. EPSS: 86.8% chance of exploitation in the next 30 days. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an…
CVE-2021-41184, published 2021-10-26. Medium severity, CVSS 6.1. EPSS: 40.8% chance of exploitation in the next 30 days. jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code.…
CVE-2021-41182, published 2021-10-26. Medium severity, CVSS 6.1. EPSS: 39.4% chance of exploitation in the next 30 days. jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted…
CVE-2016-7103, published 2017-03-15. Medium severity, CVSS 6.1. EPSS: 22.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.
CVE-2021-41183, published 2021-10-26. Medium severity, CVSS 6.1. EPSS: 8.5% chance of exploitation in the next 30 days. jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted…
CVE-2020-7760, published 2020-10-30. High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days. This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in…
CVE-2020-26870, published 2020-10-07. Medium severity, CVSS 6.1. EPSS: 4.9% chance of exploitation in the next 30 days. Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML,…
CVE-2020-9281, published 2020-03-07. Medium severity, CVSS 6.1. EPSS: 4.3% chance of exploitation in the next 30 days. A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with…
CVE-2016-3467, published 2016-07-21. Medium severity, CVSS 5.8. EPSS: 3.2% chance of exploitation in the next 30 days. Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.4 allows remote attackers to affect availability via unknown vectors.

Latest

CVE-2025-50067, published 2025-07-15. Critical severity, CVSS 9.0. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Express (component: Strategic Planner Starter App). Supported versions that are affected are 24.2.4 and 24.2.5. Easily exploitable vulnerability allows low…
CVE-2025-21557, published 2025-01-21. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23.2 and 24.1. Easily exploitable vulnerability allows low privileged attacker with…
CVE-2024-21261, published 2024-10-15. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in Oracle Application Express (component: General). Supported versions that are affected are 23.2 and 24.1. Difficult to exploit vulnerability allows low privileged attacker with…
CVE-2023-21983, published 2023-07-18. Medium severity, CVSS 5.6. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Application Express Administration product of Oracle Application Express (component: None). Supported versions that are affected are Application Express Administration:…
CVE-2023-21975, published 2023-07-18. Critical severity, CVSS 9.0. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Customers…
CVE-2023-21974, published 2023-07-18. Critical severity, CVSS 9.0. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account). Supported versions that are affected are Application Express Team…
CVE-2022-24729, published 2022-03-16. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog…
CVE-2022-24728, published 2022-03-16. Medium severity, CVSS 5.4. EPSS: 1.2% chance of exploitation in the next 30 days. CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to…
CVE-2021-41165, published 2021-11-17. Medium severity, CVSS 5.4. EPSS: 1.6% chance of exploitation in the next 30 days. CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The…
CVE-2021-41164, published 2021-11-17. Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days. CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4.…