A vulnerability exists in the Supplier Registration component of Oracle PeopleSoft Enterprise SCM Purchasing 9.2 that allows a low-privileged attacker with network access via HTTP to manipulate data. The flaw enables unauthorized insert, update, or delete operations and unauthorized read of sensitive data, resulting in integrity and confidentiality impact. The vulnerability requires some human interaction from a non-attacker user, but the potential for data manipulation is significant due to the scope change that may affect additional products.

Oracle Corporation PeopleSoft Enterprise SCM Purchasing version 9.2 is affected. No other specific product or version information is provided.

The CVSS v3.1 base score is 5.4, indicating moderate risk to confidentiality and integrity. The EPSS score is not available, so the current exploitation probability is unknown, and the flaw is not listed in CISA KEV. Because the attack vector is over HTTP and requires low privilege and user interaction, the likelihood of successful exploitation in a typical environment is lower, yet it remains a concern for exposed systems that accept HTTP requests from untrusted networks.