This vulnerability in the Oracle PeopleSoft Enterprise HCM Shared Components allows a low‑privileged attacker who can reach the application over HTTP to manipulate data. The flaw resides in the Person Search component and requires the cooperation of a user other than the attacker. When successfully exploited, the attacker can insert, update, or delete data, as well as read restricted data, thereby breaching confidentiality and integrity of the application and potentially the underlying database.

Oracle Corporation’s PeopleSoft Enterprise HCM Shared Components, version 9.2, is affected. Because the vulnerability can change scope, other integrated PeopleSoft products that rely on the shared components may also be impacted if they do not enforce proper access controls.

The CVSS 3.1 base score of 5.4 indicates moderate severity with impacts to confidentiality and integrity. The EPSS score is not available, suggesting limited public exploitation data. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a network‑based HTTP request. Successful exploits require a low‑privileged attacker and a victim user’s interaction, but the presence of scope changes raises the potential for broader impact across related products.