What is CVE-2025-50067?

CVE-2025-50067 is a critical-severity vulnerability in Oracle Application Express, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 9.0/10. Published 2025-07-15.

How severe is CVE-2025-50067?

Critical severity. CVSS v3 base score is 9.0 out of 10.

Open Redirect in Oracle Application Express

CVE-2025-50067

Vulnerability in Oracle Application Express (component: Strategic Planner Starter App). Supported versions that are affected are 24.2.4 and 24.2.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Express, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Application Express. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

Vulnerability class: Open Redirect

EPSS: 0.003 (21.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

Affected products

Oracle Application_express — versions 24.2.4, 24.2.5
Oracle Corporation Application Express — versions 24.2.4, 24.2.5

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

secalert_us@oracle.com (vendor-advisory, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2025-50067?: CVE-2025-50067 is a critical-severity vulnerability in Oracle Application Express, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 9.0/10. Published 2025-07-15.
How severe is CVE-2025-50067?: Critical severity. CVSS v3 base score is 9.0 out of 10.