CVE-2005-3202

Oracle HTML DB 1.3-1.3.6 - Cross-Site Scripting via p or p_t02 Parameters

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2005-3202. PoCs published by Red-Database-Security.

AI-analyzed exploit summary This exploit demonstrates a cross-site scripting (XSS) vulnerability in Oracle HTML DB by injecting arbitrary script code via crafted URL parameters. It also highlights the potential for SQL injection by embedding SQL statements in the payload.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTML DB (HTMLDB) 1.3 through 1.3.6 allow remote attackers to inject arbitrary web script or HTML, and subsequently execute SQL statements via the (1) p or (2) p_t02 parameters.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Red-Database-Security · textremotemultiple
https://www.exploit-db.com/exploits/26330

This exploit demonstrates a cross-site scripting (XSS) vulnerability in Oracle HTML DB by injecting arbitrary script code via crafted URL parameters. It also highlights the potential for SQL injection by embedding SQL statements in the payload.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Oracle HTML DB (version not specified)
No auth needed
Prerequisites: Access to the target Oracle HTML DB instance
MITRE ATT&CK
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by Red-Database-Security · textremotemultiple
https://www.exploit-db.com/exploits/26329

The exploit demonstrates a cross-site scripting (XSS) vulnerability in Oracle HTML DB by crafting a malicious URL that injects JavaScript code into the 'p' parameter. This allows arbitrary script execution in the context of the affected site, potentially leading to session hijacking or SQL injection.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Oracle HTML DB (version not specified)
No auth needed
Prerequisites: Access to a vulnerable Oracle HTML DB instance · Victim interaction to visit the crafted URL
MITRE ATT&CK
mistral-large-3 · analyzed Feb 18, 2026 Full analysis →

References (10)

Core 10
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/20052
Third Party Advisory third-party-advisory x_refsource_sreason
http://securityreason.com/securityalert/62
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/14935/
Mailing List mailing-list x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=112870398418456&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/22540
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/20051
Exploit, Vendor Advisory mailing-list x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0173.html
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/15031

Scores

EPSS 0.1098
EPSS Percentile 95.4%

Details

Status published
Products (2)
oracle/html_db 1.3
oracle/html_db 1.3.6
Published Oct 14, 2005
Tracked Since Feb 18, 2026