CVE Watch1 de out. de 2026

CVE-2019-2725

Oracle WebLogic Server, Injection

CVSS

9.8

Crítica

EPSS

100.0%

p100

KEV

SIM

10 de jan. de 2022

Exploit Today

0-100

Publicado: 26 de abr. de 2019 · Última mod.: 1 de out. de 2026 · CWE-74

EPSS · 30d

100.0%EPSS · 30 dias100.0%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

Oracle / WebLogic Server

Vulnerabilidade

Oracle WebLogic Server, Injection

Adicionado ao KEV

10 de jan. de 2022

Corrigir até

10 de jul. de 2022

Uso conhecido em ransomware

Sim

Descrição resumida

Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).

Ação necessária

Apply updates per vendor instructions.

Notas

https://nvd.nist.gov/vuln/detail/CVE-2019-2725

Descrição técnica

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1230287.3 ALT

—

——0A vulnerability was identified in itsourcecode Online Book Store 1.0. Affected by this issue is some unknown functionality of the file /admin_edit.php. The manipulation of the argument bookisbn leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.7h CVE-2026-1230188.3 ALT

—

——0A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.14h CVE-2026-1221916.3 MÉD

10.0%

——3A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/manage_booked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.22h CVE-2026-12205110.0 CRÍ

85.2%

——26A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.1d CVE-2026-1220507.3 ALT

18.2%

——5A vulnerability was found in Campcodes Complete Sales and Inventory System with Credit Management 1.0. This issue affects some unknown processing of the file /ahira/login.php. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.1d CVE-2026-1220487.3 ALT

18.2%

——5A vulnerability was identified in Campcodes Division Regional Athletic Meet Game Result Matrix System up to 2.1. This affects an unknown function of the file /dipam/check-user.php. Such manipulation of the argument abbr leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.1d