CVE-2026-91511

Vulnerability in Oracle E-Business Suite's Oracle Purchasing product (component: PO View Document) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged network attacker via HTTP to gain unauthorized access to critical data or all Oracle Purchasing accessible data.

Vulnerability in Oracle E-Business Suite's Oracle Purchasing product (component: Approvals) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows an unauthenticated network attacker via HTTP to modify some Oracle Purchasing data and read a subset of data, requiring user interaction and potentially impacting additional products.

Vulnerability in the Internal Operations component of Oracle Purchasing in Oracle E-Business Suite versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete access to some data, requiring user interaction.

Vulnerability in the Internal Operations component of Oracle Purchasing in Oracle E-Business Suite versions 12.2.3-12.2.15. A difficult to exploit flaw allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete access to some data.

Vulnerability in Oracle Purchasing (component: Other issue) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low privileged attacker with network access via HTTP to create, delete or modify data and gain unauthorized access to critical information.

Vulnerability in Oracle Purchasing (component: G-Invoicing) versions 12.2.10-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in unauthorized creation, deletion, or modification of data and unauthorized access to data.

Vulnerability in Oracle Purchasing (component: G-Invoicing) versions 12.2.11-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in unauthorized creation, deletion, or modification of data and unauthorized access to data.

Vulnerability in Oracle Purchasing (component: Other issue) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in unauthorized creation, deletion, or modification of data and unauthorized access to data.

Vulnerability in Oracle Purchasing (component: Other issue) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can easily exploit this flaw. Successful attacks can result in takeover of the Oracle Purchasing system.

Vulnerability in Oracle Purchasing within Oracle E-Business Suite (component: G-Invoicing) affecting versions 12.2.10-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the system. It can lead to unauthorized access to critical data, and the attack may impact additional products (scope change).