PT-2025-42998 · Oracle · Oracle Marketing+1

Published 2025-10-21 · Updated 2025-11-17 · CVE-2025-62481

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Oracle Marketing versions 12.2.3 through 12.2.14

Description An easily exploitable issue exists in the Oracle Marketing component of Oracle E-Business Suite. An unauthenticated attacker with network access via HTTP can compromise Oracle Marketing, potentially leading to a complete takeover of the system. The issue allows for remote code execution.

Recommendations For versions 12.2.3 through 12.2.14, restrict network access to the affected component.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-13389

CVE-2025-62481

Affected Products

Oracle E-Business Suite

Oracle Marketing

References · 20

• 🔥 https://github.com/B1ack4sh/Blackash-CVE-2025-62481 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62481 · Security Note
• https://bdu.fstec.ru/vul/2025-13389 · Security Note
• https://oracle.com/security-alerts/cpuoct2025.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62481 · Vendor Advisory
• https://twitter.com/offseq/status/1980809505039327394 · Twitter Post
• https://twitter.com/UjlakiMarci/status/1980948874215764429 · Twitter Post
• https://t.me/pentestingnews/69937 · Telegram Post
• https://twitter.com/Fisjkars/status/1980964507527622659 · Twitter Post
• https://twitter.com/ashrafzaryouh/status/1981580030921621979 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1980760192292716689 · Twitter Post
• https://t.me/CVEtracker/35436 · Telegram Post
• https://twitter.com/zoomeye_team/status/1981306609239544089 · Twitter Post
• https://twitter.com/DefusedCyber/status/1980937798212284692 · Twitter Post
• https://twitter.com/rxerium/status/1980933235589722515 · Twitter Post