Ezsystems/ezpublish-kernel
15 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Ezsystems/ezpublish-kernel, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Ezsystems/ezpublish-kernel CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 15 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High1
- Medium2
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Ezsystems/ezpublish-kernel.
- GHSA-64vj-933f-6pm3eZ Platform Object Injection in SiteAccessMatchListener—
- GHSA-3vwr-jj4f-h98xeZ Publish Remote code execution in file uploads—
- GHSA-9wwx-c723-vm8xeZ Platform REST API returns list of all SiteAccesses—
- GHSA-946c-f9w6-2c25Download route allows filename change in eZpublish kernel—
- CVE-2022-48366An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.3.7
- CVE-2022-48367An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.9.8
- CVE-2022-48365An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.7.2
- CVE-2021-46876An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.5.3
- CVE-2021-46875An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.6.1
- GHSA-99r3-xmmq-7q7geZ Platform users with the Company admin role can assign any role to any user—
- GHSA-xfqg-p48g-hh94Login timing attack in ezsystems/ezpublish-kernel—
- GHSA-5x4f-7xgq-r42xObject state limitation has no effect—
- CVE-2022-25337Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.9.8
- GHSA-44m4-9cjp-j587IBX-1392: Image filenames sanitization—
- CVE-2020-10806eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to ...9.8
Product grouping is registry-driven, with AI assist and human review. How it works