CVE-2016-2346

HIGH 8.1CVE-2016-2346 · Published 25/04/2016 · updated 17/06/2026

In short

CVE-2016-2346 is a HIGH (CVSS 8.1) vulnerability affecting pl/sql developer (allroundautomations).
Chance of exploitation in the next 30 days (EPSS): 0.94%, higher than 61.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
pl/sql developer allroundautomations	`= 11.0= 11.0.1= 11.0.2= 11.0.3= 11.0.4= 11.0.5`	No fix yet

Description

Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates, which allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream.

References

kb.cert.org/vuls/id/229047 · Third Party Advisory
adamcaudill.com/2016/02/02/plsql-developer-nonexistent-encryption · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free