The vulnerability resides in Oracle Demand Signal Repository, part of the Oracle E‑Business Suite internal operations component, and affects versions 12.2.3 through 12.2.15. It is an SQL injection flaw that is easily exploitable by a low‑privileged user who has network access to the database. By submitting crafted SQL the attacker can create, delete, or alter critical data, or gain complete read access to all data stored in the repository. The flaw carries a CVSS 3.1 Base Score of 8.1, indicating high impact on confidentiality and integrity.

Oracle Demand Signal Repository versions 12.2.3 to 12.2.15 are affected. The vulnerability is tied to the internal operations component of the product within Oracle E‑Business Suite.

The high CVSS score classifies the flaw as a critical risk, yet the EPSS score of less than 1% suggests that active exploitation is currently rare. The flaw is not listed in CISA’s KEV catalog, indicating no known wild exploits at this time. An attacker must have network connectivity to the database and possess at least a low‑privilege account; therefore, restricting database access and enforcing strict authentication can substantially reduce the attack surface.