Unscored severity · published Jul 18, 2007
CVE-2007-3860
Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack…
–
CVSS
2%
EPSS
No
On KEV
Description
Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwv_flow_security.check_db_password function due to insufficient checks for '"' characters.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Apex · Oracle
through 3.0.0.00.20; 2.2.0.00.32 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3860
h20000.www2.hp.com
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143
Vendor Advisory
http://secunia.com/advisories/26114
secunia.com
http://secunia.com/advisories/26166
securityreason.com
http://securityreason.com/securityalert/2901
www.integrigy.com
http://www.integrigy.com/security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf
www.oracle.com
http://www.oracle.com/technetwork/topics/security/cpujul2007-087014.html
More from Apex
5.5
CVE-2026-60630
Vulnerability in Oracle APEX (component: Installation)
5.4
CVE-2026-21931
Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App)
5.3
CVE-2026-60156
Vulnerability in Oracle APEX (component: General)
–
CVE-2007-3854
Multiple unspecified vulnerabilities in Oracle Database 9.0.1.5+, 9.2.0.7, and 10.1.0.5 allow remote authenticated users to have unknown impact via (1) SYS.DBMS_PRVTAQIS in the…
–
CVE-2006-7138
SQL injection vulnerability in wwv_flow_utilities.gen_popup_list in the WWV_FLOW_UTILITIES package for Oracle APEX/HTMLDB before 2.2 allows remote authenticated users to execute…