← Vulnerability feed

Vulnerability record · CVE-2007-1506 · published 19 March 2007

CVE-2007-1506: Oracle application server portal vulnerability

Oracle · Application Server Portal

Cross-site scripting (XSS) vulnerability in PORTAL.wwv_main.render_warning_screen in the Oracle Portal 10g allows remote attackers to inject arbitrary web script or HTML via the (1) p_oldurl and (2) p_newurl parameters.

4.3 CVSS 2.0 Medium EPSS 1.8% · top 22.3%
4.3CVSS 2.0 base score
1.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
16 Jun 2026Last modified by NVD

Description

Cross-site scripting (XSS) vulnerability in PORTAL.wwv_main.render_warning_screen in the Oracle Portal 10g allows remote attackers to inject arbitrary web script or HTML via the (1) p_oldurl and (2) p_newurl parameters.

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://osvdb.org/34299
http://securityreason.com/securityalert/2463
http://www.securityfocus.com/archive/1/463012/100/0/threaded
http://www.securityfocus.com/bid/22999
https://exchange.xforce.ibmcloud.com/vulnerabilities/33028
http://osvdb.org/34299
http://securityreason.com/securityalert/2463
http://www.securityfocus.com/archive/1/463012/100/0/threaded
http://www.securityfocus.com/bid/22999
https://exchange.xforce.ibmcloud.com/vulnerabilities/33028

Track CVE-2007-1506 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2006-6697Oracle application server portal vulnerabilityCRLF injection vulnerability in webapp/jsp/calendar.jsp in Oracle Portal 10g and earlier, including 9.0.2, allows remote attackers to inject arbitrar…EPSS 13%7.5CVE-2003-1193Oracle application server portal vulnerabilityMultiple SQL injection vulnerabilities in the Portal DB (1) List of Values (LOVs), (2) Forms, (3) Hierarchy, and (4) XML components packages in Oracl…EPSS 1.8%7.2CVE-2004-1707Oracle application server vulnerabilityThe (1) dbsnmp and (2) nmo programs in Oracle 8i, Oracle 9i, and Oracle IAS 9.0.2.0.1, on Unix systems, use a default path to find and execute librar…EPSS 2.6%5.0CVE-2008-2138Oracle application server portal permissions and access controls vulnerabilityOracle Application Server (OracleAS) Portal 10g allows remote attackers to bypass intended access restrictions and read the contents of /dav_portal/p…EPSS 16%5.0CVE-2006-6699Oracle application server portal vulnerabilityMultiple CRLF injection vulnerabilities in Oracle Portal 9.0.2 and possibly other versions allow remote attackers to inject arbitrary HTTP headers an…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2007-1506), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.