PT-2026-29009 · Navicat · Navicat For Oracle

Victor Mondragón · Published 2026-03-30 · Updated 2026-04-08 · CVE-2019-25653

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Navicat for Oracle version 12.1.15

Description Navicat for Oracle version 12.1.15 contains a denial of service issue that allows local attackers to crash the application. This occurs by providing an excessively long string in the password field during Oracle connection configuration. Specifically, pasting a buffer of 550 repeated characters into the password parameter can trigger an application crash.

Recommendations Avoid using excessively long strings in the password parameter during Oracle connection configuration.

Exploit

Fix

DoS

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2019-25653

Affected Products

Navicat For Oracle

References · 6

• 🔥 https://exploit-db.com/exploits/46383 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25653 · Security Note
• https://vulncheck.com/advisories/navicat-for-oracle-password-field-denial-of-service · Note
• https://t.me/cveNotify/158476 · Telegram Post
• https://navicat.com/es/download/navicat-for-oracle · Note
• https://navicat.com/es · Note