CVE-2025-62481

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability can result in takeover of Oracle Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2025
Last modified: Oct 8, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-624826.1Cross-site scripting in Zoom Workplace for Windows before version 6.5.10 may allow an unauthenticated user to impact integrity via network a CVE-2025-624837.5Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a discl CVE-2025-624849.8Inefficient regular expression complexity in certain Zoom Workplace Clients before version 6.5.10 may allow an unauthenticated user to condu CVE-2025-624873.5On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the prop CVE-2025-62496.7An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions CVE-2025-624908.8In quickjs, in js_print_object, when printing an array, the function first fetches the array length and then loops over it. The issue is, pr CVE-2025-624918.8A Use-After-Free (UAF) vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled reject CVE-2025-624926.5A vulnerability stemming from floating-point arithmetic precision errors exists in the QuickJS engine's implementation of TypedArray.prototy CVE-2025-624936.5A vulnerability exists in the QuickJS engine's BigInt string conversion logic (js_bigint_to_string1) due to an incorrect calculation of the CVE-2025-624948.8A type confusion vulnerability exists in the handling of the string addition (+) operation within the QuickJS engine. * The code first c CVE-2025-624958.8An integer overflow vulnerability exists in the QuickJS regular expression engine (libregexp) due to an inconsistent representation of the b CVE-2025-624968.8A vulnerability exists in the QuickJS engine's BigInt string parsing logic (js_bigint_from_string) when attempting to create a BigInt from a