Skip to content

Tools Exploits Blog

Tools Exploits Blog

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Feeds Contact Privacy© 2026 Kitploit

Tool Directory

Categories

View all categories

Loading categories

Back to Exploits

CVE-2012-3152

CriticalPublished

Oracle Fusion Middleware Unspecified Vulnerability

Published: Oct 16, 2012
Updated: Oct 22, 2025
Assigning CNA: oracle
Evidence observed: Jan 29, 2014

Primary CVSS

9.1/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS probability estimate

98.8%

High · next 30 days

Percentile: 99.9%
Model date: Oct 15, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

Oracle Forms and Reports Remote Code ExecutionModule
modules/exploits/multi/http/oracle_reports_rce.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: fa174ade81b5Related tool
Declared conditions
- platform: Linux,Windows($.exploit_multi/http/oracle_reports_rce.platform)
- verification: check_declared($.exploit_multi/http/oracle_reports_rce.check)

pwnacle-fusionExploit
Automated exploit for CVE-2012-3153 / CVE-2012-3152
rwsploitExploit
Automated exploitation scanner for Oracle Reports Server (rwservlet) — CVE-2012-3152 / CVE-2012-3153. Detects, fingerprints, reads files via LFI, tests SSRF via webhook, and uploads JSP shells. Targets Oracle Reports < 11g. For authorized use only.
Oracle Forms and Reports 11.1 - Arbitrary Code ExecutionExploit
Mekanismen · jsp · Jan 29, 2014
Oracle Forms and Reports - Remote Code Execution (Metasploit)Exploit
Metasploit · windows · Feb 18, 2014

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.