A flaw in the Oracle iStore Shopping Cart component allows an attacker with low‑privileged credentials and network access over HTTP to compromise the system. If exploited, the attacker can create, delete or modify critical data and gain read access to all data exposed by Oracle iStore, resulting in significant confidentiality and integrity loss.

Oracle iStore, part of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15 are affected. Users running these embedded shopping‑cart applications are at risk if the software has not been updated.

The CVSS v3.1 score of 8.1 classifies this as high severity, while the EPSS score of less than 1 % indicates a low probability of exploitation today. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only network connectivity to the public HTTP interface and a low‑privilege user account, making the threat realistic for attackers with modest access.