CVE-2005-2372
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them...
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
Exploit likelihood
What each source reports
NVD Score used
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
- Record
CVE-2005-2372- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
- Record
CVE-2005-2372- Updated
- 2026-11-02
EUVDEUVD-2005-2373 No score
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
- Record
EUVD-2005-2373- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h3q5-7899-7pxx No score
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them...
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
- Record
GHSA-h3q5-7899-7pxx- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-2372 is a high vulnerability (CVSS 7.2) in Oracle Forms, published July 26, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.86%, the 86th percentile. No source names a fixed version.