Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Oracle APEX lets attackers insert malicious code

CVE-2006-5599 · published 20 years ago
Summary

The Oracle Application Express web development tool (versions before 2.2.1) can be tricked into adding harmful HTML or scripts to pages. This could let a remote user display unwanted content to anyone viewing the affected pages, potentially stealing information or spreading malware. Apply the October 2006 update or later patches to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oracle apex 2.2
cpe:2.3:a:oracle:apex:2.2:*:*:*:*:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in Oracle Application Express (formerly HTML DB) before 2.2.1 allows remote attackers to inject arbitrary HTML or web script via the WWV_FLOW_ITEM_HELP pack...
Cross-site scripting (XSS) vulnerability in Oracle Application Express (formerly HTML DB) before 2.2.1 allows remote attackers to inject arbitrary HTML or web script via the WWV_FLOW_ITEM_HELP package. NOTE: it is likely that this issue overlaps one of the Oracle VulnIDs covered by CVE-2006-5351. Oracle has not publicly disputed claims by a reliable researcher that this has been fixed by the October 2006 CPU.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published28 Oct 2006
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-5599 · NVD
Track software like this
Free during beta