AE
Product
Application Express
On CISA KEVExploited in the wild
47
CVEs
1
On KEV
9.0
Max CVSS
0
New 30D
Severity mix
Critical 3High 2Medium 40Low 0
Watch
Add Application Express to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-11023 In wildKEV | 6.1 | Apr 29 | Potential XSS vulnerability in jQuery Affected: before 20.2 |
| CVE-2025-50067 | 9.0 | Jul 15 | Vulnerability in Oracle Application Express (component: Strategic Planner Starter App) Affected: 24.2.4; 24.2.5 |
| CVE-2023-21975 | 9.0 | Jul 18 | Vulnerability in the Application Express Customers Plugin product of Oracle Application Express (component: User Account) Affected: 18.2 through 22.2 |
| CVE-2023-21974 | 9.0 | Jul 18 | Vulnerability in the Application Express Team Calendar Plugin product of Oracle Application Express (component: User Account) Affected: 18.2 through 22.1 |
| CVE-2022-24729 | 7.5 | Mar 16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: before 22.1.1 |
| CVE-2020-7760 | 7.5 | Oct 30 | This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2 Affected: before 20.2 |
| CVE-2021-32723 | 6.5 | Jun 28 | Prism is a syntax highlighting library Affected: before 21.1.4 |
| CVE-2021-26272 | 6.5 | Jan 26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space… Affected: before 21.1.0 |
| CVE-2021-26271 | 6.5 | Jan 26 | It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the… Affected: before 21.1.0 |
| CVE-2021-41184 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: before 22.1.1 |
| CVE-2021-41183 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: before 22.1.1 |
| CVE-2021-41182 | 6.1 | Oct 26 | jQuery-UI is the official jQuery user interface library Affected: before 22.1.1 |
| CVE-2020-27193 | 6.1 | Nov 12 | A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and… Affected: before 21.1.0.00.01 |
| CVE-2020-26870 | 6.1 | Oct 7 | Cure53 DOMPurify before 2.0.17 allows mutation XSS Affected: before 21.1.0.00.01 |
| CVE-2020-9281 | 6.1 | Mar 7 | A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14 allows remote attackers to inject arbitrary web script through a crafted… Affected: before 20.2 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: 21.1.4 |
| CVE-2019-11358 | 6.1 | Apr 20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: before 19.1 |
| CVE-2018-2699 | 6.1 | Jan 18 | Vulnerability in the Application Express component of Oracle Database Server Affected: through 5.1.4.00.08 |
| CVE-2016-7103 | 6.1 | Mar 15 | Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog… Affected: before 19.1 |
| CVE-2016-3448 | 6.1 | Jul 21 | Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.4 allows remote attackers to affect confidentiality and integrity via unknown… Affected: through 5.0.3 |
| CVE-2016-3467 | 5.8 | Jul 21 | Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.4 allows remote attackers to affect availability via unknown vectors Affected: through 5.0.3 |
| CVE-2023-21983 | 5.6 | Jul 18 | Vulnerability in the Application Express Administration product of Oracle Application Express (component: None) Affected: 18.2 through 22.2 |
| CVE-2025-21557 | 5.4 | Jan 21 | Vulnerability in Oracle Application Express (component: General) Affected: 23.2; 24.1 |
| CVE-2022-24728 | 5.4 | Mar 16 | CKEditor4 is an open source what-you-see-is-what-you-get HTML editor Affected: before 22.1.1 |
| CVE-2021-41165 | 5.4 | Nov 17 | CKEditor4 is an open source WYSIWYG HTML editor Affected: before 22.1 |
| CVE-2021-41164 | 5.4 | Nov 17 | CKEditor4 is an open source WYSIWYG HTML editor Affected: before 22.1 |
| CVE-2021-37695 | 5.4 | Aug 13 | ckeditor is an open source WYSIWYG HTML editor with rich content support Affected: before 21.1.4 |
| CVE-2021-32809 | 5.4 | Aug 12 | ckeditor is an open source WYSIWYG HTML editor with rich content support Affected: before 21.1.4 |
| CVE-2021-32808 | 5.4 | Aug 12 | ckeditor is an open source WYSIWYG HTML editor with rich content support Affected: before 21.1.4 |
| CVE-2021-2460 | 5.4 | Jul 21 | Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server Affected: before 21.1.0.00.04 |
| CVE-2020-14900 | 5.4 | Oct 21 | Vulnerability in the Oracle Application Express Group Calendar component of Oracle Database Server Affected: before 20.2 |
| CVE-2020-14899 | 5.4 | Oct 21 | Vulnerability in the Oracle Application Express Data Reporter component of Oracle Database Server Affected: before 20.2 |
| CVE-2020-14898 | 5.4 | Oct 21 | Vulnerability in the Oracle Application Express Packaged Apps component of Oracle Database Server Affected: before 20.2 |
| CVE-2020-14763 | 5.4 | Oct 21 | Vulnerability in the Oracle Application Express Quick Poll component of Oracle Database Server Affected: before 20.2 |
| CVE-2020-14762 | 5.4 | Oct 21 | Vulnerability in the Oracle Application Express component of Oracle Database Server Affected: before 20.2 |
| CVE-2020-2976 | 5.4 | Jul 15 | Vulnerability in the Oracle Application Express component of Oracle Database Server Affected: 5.1 through 19.2 |
| CVE-2020-2975 | 5.4 | Jul 15 | Vulnerability in the Oracle Application Express component of Oracle Database Server Affected: 5.1 through 19.2 |
| CVE-2020-2974 | 5.4 | Jul 15 | Vulnerability in the Oracle Application Express component of Oracle Database Server Affected: 5.1 through 19.2 |
| CVE-2020-2973 | 5.4 | Jul 15 | Vulnerability in the Oracle Application Express component of Oracle Database Server Affected: 5.1 through 19.2 |
| CVE-2020-2972 | 5.4 | Jul 15 | Vulnerability in the Oracle Application Express component of Oracle Database Server Affected: 5.1 through 19.2 |
| CVE-2020-2971 | 5.4 | Jul 15 | Vulnerability in the Oracle Application Express component of Oracle Database Server Affected: 5.1 through 19.2 |
| CVE-2020-2513 | 5.4 | Jul 15 | Vulnerability in the Oracle Application Express component of Oracle Database Server Affected: 5.1 through 19.2 |
| CVE-2024-21261 | 4.9 | Oct 15 | Vulnerability in Oracle Application Express (component: General) Affected: 23.2; 24.1 |
| CVE-2020-2977 | 4.6 | Jul 15 | Vulnerability in the Oracle Application Express component of Oracle Database Server Affected: 5.1 through 19.2 |
| CVE-2020-2514 | 4.6 | Apr 15 | Vulnerability in the Oracle Application Express component of Oracle Database Server Affected: before 19.2 |
| CVE-2008-1822 | – | Apr 16 | Unspecified vulnerability in the Oracle Application Express component in Oracle Application Express 3.0.1 has unknown impact and remote attack vectors, aka APEX02 Affected: 3.0.1 |
| CVE-2008-1811 | – | Apr 16 | Unspecified vulnerability in Oracle Application Express 3.0.1 has unspecified impact and remote authenticated attack vectors related to flows_030000.wwv_execute_immediate, aka… Affected: 3.0.1 |
Showing 47