CVE-2006-5338
Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5 has unknown...
Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5 has unknown impact and remote authenticated attack vectors related to sys.dbms_sqltune, aka Vuln# DB10. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB10 is for SQL injection in DROP_SQLSET, DELETE_SQLSET, SELECT_SQLSET, and I_SET_TUNING_PARAMETER. NOTE: some of these vectors might be in DBMS_SQLTUNE_INTERNAL.
Exploit likelihood
What each source reports
NVD Score used
Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5 has unknown impact and remote authenticated attack vectors related to sys.dbms_sqltune, aka Vuln# DB10. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB10 is for SQL injection in DROP_SQLSET, DELETE_SQLSET, SELECT_SQLSET, and I_SET_TUNING_PARAMETER. NOTE: some of these vectors might be in DBMS_SQLTUNE_INTERNAL.
- Record
CVE-2006-5338- CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5 has unknown impact and remote authenticated attack vectors related to sys.dbms_sqltune, aka Vuln# DB10. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB10 is for SQL injection in DROP_SQLSET, DELETE_SQLSET, SELECT_SQLSET, and I_SET_TUNING_PARAMETER. NOTE: some of these vectors might be in DBMS_SQLTUNE_INTERNAL.
- Record
CVE-2006-5338- Updated
- 2026-11-02
EUVDEUVD-2006-5323 No score
Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5 has unknown impact and remote authenticated attack vectors related to sys.dbms_sqltune, aka Vuln# DB10. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB10 is for SQL injection in DROP_SQLSET, DELETE_SQLSET, SELECT_SQLSET, and I_SET_TUNING_PARAMETER. NOTE: some of these vectors might be in DBMS_SQLTUNE_INTERNAL.
- Record
EUVD-2006-5323- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-648r-gxw4-j288 No score
Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5 has unknown...
Unspecified vulnerability in the Core RDBMS component in Oracle Database 10.1.0.5 has unknown impact and remote authenticated attack vectors related to sys.dbms_sqltune, aka Vuln# DB10. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB10 is for SQL injection in DROP_SQLSET, DELETE_SQLSET, SELECT_SQLSET, and I_SET_TUNING_PARAMETER. NOTE: some of these vectors might be in DBMS_SQLTUNE_INTERNAL.
- Record
GHSA-648r-gxw4-j288- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-5338 is a high vulnerability (CVSS 9.0) in Oracle Database Server, published October 18, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.03%, the 87th percentile. No source names a fixed version.
References
red-database-security.com/advisory/oracle_cpu_oct_2006.html
securityfocus.com/bid/20588
oracle.com/technetwork/topics/security/cpuoct2006-095368.html
databasesecurity.com/oracle/OracleOct2006-CPU-Analysis.pdf
Show 8 moreShow less
vupen.com/english/advisories/2006/4065
secunia.com/advisories/22396
securitytracker.com/id?1017077
us-cert.gov/cas/techalerts/TA06-291A.html
nvd.nist.gov/vuln/detail/CVE-2006-5338
github.com/advisories/GHSA-648r-gxw4-j288