Listen to this Post
How the CVE Works
CVE-2025-30746 is a stored Cross-Site Scripting (XSS) vulnerability in Oracle iStore (component: Shopping Cart) affecting versions 12.2.3 to 12.2.14. An unauthenticated attacker can exploit this flaw via crafted HTTP requests, requiring victim interaction. The vulnerability allows injecting malicious scripts into the shopping cart module, which executes in the victim’s browser context. Successful exploitation leads to unauthorized data manipulation (insert/update/delete) and partial data theft due to inadequate input sanitization in the web interface.
DailyCVE Form
Platform: Oracle E-Business Suite
Version: 12.2.3-12.2.14
Vulnerability: Stored XSS
Severity: Medium
Date: 07/25/2025
Prediction: Patch by 10/2025
What Undercode Say
Analytics:
nmap -p 80,443 --script http-vuln-cve2025-30746 <target> curl -X POST -d "cart=<script>alert(1)</script>" http://<target>/istore/add
How Exploit:
- Craft malicious cart payload via HTTP.
- Lure victim to interact with infected cart.
- Steal session cookies/data.
Protection from this CVE:
- Apply Oracle patch.
- Sanitize user inputs.
- Enable CSP headers.
Impact:
- Data leakage.
- Session hijacking.
- Unauthorized modifications.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
