PT-2025-42969 · Oracle · Oracle E-Business Suite+1

Published 2025-10-21 · Updated 2025-11-17 · CVE-2025-53072

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Marketing versions 12.2.3 through 12.2.14

Description This issue affects the Oracle Marketing product within Oracle E-Business Suite. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing, potentially leading to a complete takeover of the system. The vulnerability is easily exploitable.

Recommendations For versions 12.2.3 through 12.2.14, apply a patch as soon as possible. Restrict access to the affected component to minimize the risk of exploitation.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-14330

CVE-2025-53072

Affected Products

Oracle E-Business Suite

Oracle Marketing

References · 23

• 🔥 https://github.com/B1ack4sh/Blackash-CVE-2025-53072 · Exploit
• https://bdu.fstec.ru/vul/2025-14330 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-53072 · Security Note
• https://oracle.com/security-alerts/cpuoct2025.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53072 · Vendor Advisory
• https://twitter.com/rxerium/status/1980933235589722515 · Twitter Post
• https://t.me/pentestingnews/69937 · Telegram Post
• https://t.me/cveNotify/139913 · Telegram Post
• https://twitter.com/Fisjkars/status/1980964507527622659 · Twitter Post
• https://twitter.com/offseq/status/1980854829242106116 · Twitter Post
• https://twitter.com/DefusedCyber/status/1980937798212284692 · Twitter Post
• https://twitter.com/ashrafzaryouh/status/1981580030921621979 · Twitter Post
• https://twitter.com/UjlakiMarci/status/1980948874215764429 · Twitter Post
• https://twitter.com/CveFindCom/status/1980728454069862620 · Twitter Post
• https://twitter.com/0dayPublishing/status/1981052777901052333 · Twitter Post