Vulnerability index

Browse CVEs

9 matching
Filters 1 Clear all
Severity

Filters apply as you choose them.

Ez Platform HIGH 7.5
CVE-2025-70363

Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access sensitive…

Fix: after 2.5.32
Fix from $1,950 2026-03-06
Ezpublish Legacy MEDIUM 5.4
CVE-2020-23065

Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attacker to ex…

Mitigation only
Fix from $1,600 2023-06-26
Digital Experience Platform CRITICAL 9.8
CVE-2022-48367

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.

Fix: 1.1.9 / 1.3.17+
Fix from $2,300 2023-03-12
Digital Experience Platform HIGH 7.2
CVE-2022-48365

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.

Fix: 1.3.26 / 2.5.31+
Fix from $1,950 2023-03-12
Ez Platform Kernel MEDIUM 6.1
CVE-2021-46875

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js…

Fix: 1.2.5.1 / 1.3.1.1+
Fix from $1,600 2023-03-12
Ez Platform Kernel MEDIUM 5.3
CVE-2021-46876

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.

Fix: 6.13.8.1 / 7.5.15.1+
Fix from $1,600 2023-03-12
Ezplatform Graphql MEDIUM 5.3
CVE-2022-41876

ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecur…

Fix: 1.0.13 / 2.3.12+
Fix from $1,600 2022-11-10
Ez Platform Kernel CRITICAL 9.8
CVE-2022-25337

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.

Fix: 1.3.12 / 7.5.26+
Fix from $2,300 2022-02-18
Ez Platform Kernel MEDIUM 5.3
CVE-2022-25336

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image…

Fix: 1.3.12 / 7.5.26+
Fix from $1,600 2022-02-18