CVE-2002-1636: Cross-site scripting (XSS) vulnerability in the htp PL/SQL package for Oracle 9i Application Server (9iAS)...

Security readout for executives and security teams

This is a legacy Oracle 9i Application Server cross-site scripting issue. If an exposed application uses the affected PL/SQL htp.print path with attacker-controlled input, a visitor’s browser could run injected script or HTML. The public record does not provide severity scoring, patch details, or evidence of active exploitation. Exposure is most likely in legacy Oracle 9iAS deployments or applications still using the affected htp PL/SQL package path. Modern environments are unlikely to be exposed unless old 9iAS services remain online, internally reachable, or embedded in legacy business applications. Prioritize discovery over emergency response. This is an old issue with incomplete public severity data and no cited active exploitation, but unsupported legacy web platforms can create outsized business risk if still exposed. Mitigation focus: Inventory Oracle 9iAS and PL/SQL web application deployments.; Check Oracle or product-owner guidance for historical patches or upgrade paths.; Retire, isolate, or tightly restrict access to legacy 9iAS services..

Prepared

Jun 29, 2026, 22:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.