Unrated severityNVD Advisory· Published Mar 7, 2007· Updated Apr 23, 2026
CVE-2006-7138
CVE-2006-7138
Description
SQL injection vulnerability in wwv_flow_utilities.gen_popup_list in the WWV_FLOW_UTILITIES package for Oracle APEX/HTMLDB before 2.2 allows remote authenticated users to execute arbitrary SQL by modifying the P_LOV parameter and calculating a matching MD5 checksum for the P_LOV_CHECKSUM parameter. NOTE: it is likely that this issue is subsumed by CVE-2006-5351, but due to lack of details from Oracle, this cannot be proven.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- www.red-database-security.com/advisory/oracle_apex_sql_injection_wwv_flow_utilities.htmlnvdPatch
- www.red-database-security.com/advisory/oracle_cpu_oct_2006.htmlnvdPatch
- lists.grok.org.uk/pipermail/full-disclosure/2006-October/050265.htmlnvdExploit
- securityreason.com/securityalert/2346nvd
- www.securityfocus.com/archive/1/449498/100/0/threadednvd
- exchange.xforce.ibmcloud.com/vulnerabilities/30106nvd
News mentions
0No linked articles in our index yet.