← Vulnerability feed

Vulnerability record · CVE-2005-4832 · published 31 December 2005

CVE-2005-4832: Oracle10g vulnerability

Oracle · Oracle10g

SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.

7.5 CVSS 2.0 High EPSS 42% · top 1.4%
7.5CVSS 2.0 base score
42%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References, 10 tagged exploit
16 Jun 2026Last modified by NVD

Description

SQL injection vulnerability in the Oracle Database Server 10g allows remote authenticated users to execute arbitrary SQL commands with elevated privileges via the SUBSCRIPTION_NAME parameter in the (1) SYS.DBMS_CDC_SUBSCRIBE and (2) SYS.DBMS_CDC_ISUBSCRIBE packages, a different vector than CVE-2005-1197.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.appsecinc.com/resources/alerts/oracle/2005-02.html ExploitVendor Advisory
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txt ExploitVendor Advisory
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sql ExploitVendor Advisory
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf PatchVendor Advisory
http://www.securityfocus.com/archive/1/396133 ExploitVendor Advisory
http://www.securityfocus.com/archive/1/404970 ExploitVendor Advisory
http://www.securityfocus.com/bid/13236
https://exchange.xforce.ibmcloud.com/vulnerabilities/20159
http://www.appsecinc.com/resources/alerts/oracle/2005-02.html ExploitVendor Advisory
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEExploit.txt ExploitVendor Advisory
http://www.argeniss.com/research/OraDBMS_CDC_SUBSCRIBEWorkaround.sql ExploitVendor Advisory
http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf PatchVendor Advisory
http://www.securityfocus.com/archive/1/396133 ExploitVendor Advisory
http://www.securityfocus.com/archive/1/404970 ExploitVendor Advisory
http://www.securityfocus.com/bid/13236
https://exchange.xforce.ibmcloud.com/vulnerabilities/20159

Track CVE-2005-4832 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2006-0262Oracle database server vulnerabilityUnspecified vulnerability in the Net Foundation Layer component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, 9.2.0.6, and 10.1.0.4 has u…EPSS 3.9%10.0CVE-2006-0271Oracle database server vulnerabilityUnspecified vulnerability in the Upgrade & Downgrade component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.2.0.7, and 10.1.0.4 has unspecified impa…EPSS 3.4%9.0CVE-2006-0272Oracle10g vulnerabilityUnspecified vulnerability in the XML Database component of Oracle Database server 9.2.0.7 and 10.1.0.4 has unspecified impact and attack vectors, as …EPSS 5.8%9.0CVE-2004-1371Oracle application server memory buffer overflow vulnerabilityStack-based buffer overflow in Oracle 9i and 10g allows remote attackers to execute arbitrary code via a long token in the text of a wrapped procedur…EPSS 11%8.5CVE-2004-1364Oracle application server path traversal vulnerabilityDirectory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\b…EPSS 14%7.8CVE-2004-1368Oracle application server vulnerabilityISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the l…EPSS 5.6%7.5CVE-2006-0586Oracle application server sql injection vulnerabilityMultiple SQL injection vulnerabilities in Oracle 10g Release 1 before CPU Jan 2006 allow remote attackers to execute arbitrary SQL commands via multi…EPSS 6.5%7.5CVE-2006-0552Oracle 10g enterprise manager grid control vulnerabilityUnspecified vulnerability in the Net Listener component of Oracle Database server 8.1.7.4, 9.0.1.5, 9.0.1.5 FIPS, and 9.2.0.7 has unspecified impact …EPSS 4.8%

Source: NIST National Vulnerability Database (record CVE-2005-4832), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.