CVE-2016-3536 Cross-site scripting in n/a

What is CVE-2016-3536?

CVE-2016-3536 is a high-severity cross-site scripting vulnerability in Oracle Marketing, published on 21 Jul 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via vectors related to Deliverables. NOTE: the previous information is from the July 2016 CPU. Oracle has not commented on third-party claims that this issue involves multiple cross-site scripting (XSS) vulnerabilities, which allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Which versions are affected by CVE-2016-3536?

It affects 1 product.

Products include Oracle Marketing.

How do I fix CVE-2016-3536?

No fix has been published for CVE-2016-3536 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2016-3536 being exploited?

There is no known exploitation of CVE-2016-3536 in the wild and no public exploit code.

Other vulnerabilities in Oracle Marketing

• CVE-2025-53072 Auth bypass in Oracle Marketing Critical 9.8
• CVE-2025-62481 Auth bypass in Oracle Marketing Critical 9.8
• CVE-2021-2355 Missing authorization in Marketing Critical 9.1
• CVE-2021-2205 Missing authorization in Marketing Critical 9.1
• CVE-2020-14875 Missing authorization in Marketing Critical 9.1

All Oracle Marketing vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qvr5-v2cf-q5p6.