CVE-2007-3860 json
Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have a…
published 2007-07-18 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-3844
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 80%
- public exploits
- 0
- none known
Summary
Unspecified vulnerability in Oracle Application Express (formerly Oracle HTML DB) 2.2.0.00.32 up to 3.0.0.00.20 allows developers to have an unknown impact via unknown attack vectors, aka APEX01. NOTE: a reliable researcher states that this is SQL injection in the wwv_flow_security.check_db_password function due to insufficient checks for '"' characters.
Exploit prediction
1.95% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
h20000.www2.hp.com
/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c00727143
vendor-advisory
-
secunia.com
/advisories/26114
third-party-advisory, vendor-advisory
-
securityreason.com
/securityalert/2901
third-party-advisory
- red-database-security.com /advisory/oracle_apex_sql_injection_check_db_password.html
-
secunia.com
/advisories/26166
third-party-advisory
- oracle.com /technetwork/topics/security/cpujul2007-087014.html
-
exchange.xforce.ibmcloud.com
/vulnerabilities/35499
vdb-entry
-
us-cert.gov
/cas/techalerts/TA07-200A.html
third-party-advisory, us-government-resource
-
vupen.com
/english/advisories/2007/2562
vdb-entry
-
vupen.com
/english/advisories/2007/2635
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/35490
vdb-entry
- integrigy.com /security-resources/analysis/Integrigy_Oracle_CPU_July_2007_Analysis.pdf
-
securitytracker.com
/id?1018415
vdb-entry
-
securityfocus.com
/archive/1/474002/100/0/threaded
mailing-list
- red-database-security.com /advisory/oracle_cpu_jul_2007.html
Sources
- CVE List CVE-2007-3860
- NVD CVE-2007-3860
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.