CVE-2025-61885

MediumCVSS 4.3

Published: 21/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

Vulnerability in Oracle Life Sciences InForm (Web Server component) version 7.0.1.0. A low-privileged attacker with network access via HTTP can compromise the product, resulting in unauthorized read access to a subset of data. CVSS 4.3 (Confidentiality impact).

Risk Assessment

Confidentiality of sensitive data may be compromised, potentially leading to leakage of medical or research information.

Recommendation

Apply patches provided by Oracle for version 7.0.1.0. Restrict network access to the web server and monitor logs for suspicious activity.

Other vulnerabilities in Oracle Life Sciences InForm

CVE-2025-62287Medium
Vulnerability in Oracle Life Sciences InForm (component: Web Server) version 7.0.1.0. Easily exploitable by an unauthenticated attacker with network access via HTTP, requiring user interaction. The attack may impact additional products (scope change) and result in unauthorized access to some InForm data (read, update, insert, delete). CVSS 6.1.

Original NVD description (English source)

Vulnerability in the Oracle Life Sciences InForm product of Oracle Health Sciences Applications (component: Web Server). The supported version that is affected is 7.0.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Life Sciences InForm. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Life Sciences InForm accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS