The flaw resides in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. A low‑privileged attacker who gains network access to the HTTP interface can exploit the vulnerability, but the attacker needs a victim who is not the attacker to interact with the application. Successful exploitation allows the attacker to perform unauthorized insert, update, or delete operations and to read restricted data, thereby compromising data integrity and confidentiality. The CVSS 3.1 vector indicates that network access, low attack complexity, low privilege, and required user interaction are sufficient to trigger the flaw. The moderate CVSS base score of 5.4 reflects these constraints, yet the potential for unauthorized database changes is significant.

Oracle Systems Manager is not affected. The affected product is Oracle PeopleSoft Enterprise PeopleTools, specifically the Fluid Core component in built‑in versions 8.61, 8.62 and 8.63. No other versions or optional packages are listed as impacted.

The CVSS score of 5.4 and an EPSS score <1% suggest moderate risk, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires human interaction, so purely automated attacks are unlikely. Nonetheless, an attacker could leverage social engineering to convince a user to perform an action that activates the flaw, after which the attacker can modify or read data without elevated privileges. The scope of the impact is limited to the authenticated web interface but could extend to other applications that rely on the same data store due to the scope change indicated by the vector.