What’s Vulnerable › Products

Oracle Corporation Application Express vulnerabilities

47 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 2 published in the last 12 months.

Check whether your Oracle Corporation Application Express version is affected

Exploited Oracle Corporation Application Express vulnerabilities

• CVE-2020-11023 — JQuery Cross-Site Scripting (XSS) Vulnerability

Latest Oracle Corporation Application Express vulnerabilities

• CVE-2025-50067 — (CVSS 9.0)
• CVE-2025-21557 — (CVSS 5.4)
• CVE-2024-21261 — (CVSS 4.9)
• CVE-2023-21983 — (CVSS 5.6)
• CVE-2023-21975 — (CVSS 9.0)
• CVE-2023-21974 — (CVSS 9.0)
• CVE-2022-24729 — Regular expression Denial of Service in dialog plugin (CVSS 7.5)
• CVE-2022-24728 — Cross-site Scripting in CKEditor4 (CVSS 5.4)
• CVE-2021-41165 — HTML comments vulnerability allowing to execute JavaScript code (CVSS 5.4)
• CVE-2021-41164 — Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML (CVSS 5.4)
• CVE-2021-41184 — XSS in the `of` option of the `.position()` util (CVSS 6.1)
• CVE-2021-41183 — XSS in `*Text` options of the Datepicker widget (CVSS 6.1)
• CVE-2021-41182 — XSS in the `altField` option of the Datepicker widget (CVSS 6.1)
• CVE-2021-37695 — Execution of JavaScript code using malformed HTML in ckeditor (CVSS 5.4)
• CVE-2021-32809 — Arbitrary HTML injection vulnerability in ckeditor (CVSS 5.4)
• CVE-2021-32808 — Cross-site scripting in ckeditor via abuse of undo functionality (CVSS 5.4)
• CVE-2021-2460 — (CVSS 4.9)
• CVE-2021-32723 — Regular Expression Denial of Service (ReDoS) in Prism (CVSS 6.5)
• CVE-2021-26272 — (CVSS 6.5)
• CVE-2021-26271 — (CVSS 6.5)
• CVE-2020-27193 — (CVSS 6.1)
• CVE-2020-7760 — Regular Expression Denial of Service (ReDoS) (CVSS 7.5)
• CVE-2020-14900 — (CVSS 4.9)
• CVE-2020-14899 — (CVSS 4.9)
• CVE-2020-14898 — (CVSS 4.9)