HIGHPackagist
GHSA-3vwr-jj4f-h98xeZ Publish Remote code execution in file uploads
Modified: 11/29/2024
package
Packagist/ezsystems/ezpublish-kernel
pkg:packagist/ezsystems/ezpublish-kernel
HIGHPackagist
GHSA-44m4-9cjp-j587IBX-1392: Image filenames sanitization
Modified: 12/4/2024
CRITICAL9.8Packagist
GHSA-54p5-gxq6-j98g· CVE-2020-10806eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type
Modified: 12/8/2024
CRITICALPackagist
GHSA-5x4f-7xgq-r42x· CVE-2022-48367, GHSA-h5v2-wrhp-5v35Object state limitation has no effect
Modified: 9/10/2026
HIGHPackagist
GHSA-64vj-933f-6pm3eZ Platform Object Injection in SiteAccessMatchListener
Modified: 11/29/2024
LOW3.7Packagist
GHSA-66m4-gc8h-hpjx· CVE-2022-48366Timing attack in eZ Platform Ibexa
Modified: 3/4/2025
LOWPackagist
GHSA-946c-f9w6-2c25Download route allows filename change in eZpublish kernel
Modified: 12/4/2024
CRITICALPackagist
GHSA-99r3-xmmq-7q7geZ Platform users with the Company admin role can assign any role to any user
Modified: 2/4/2026
MEDIUMPackagist
GHSA-9wwx-c723-vm8xeZ Platform REST API returns list of all SiteAccesses
Modified: 11/29/2024
MEDIUM5.3Packagist
GHSA-gmrf-99gw-vvwj· CVE-2021-46876/user/sessions endpoint allows detecting valid accounts
Modified: 5/4/2026
CRITICAL9.8Packagist
GHSA-h5v2-wrhp-5v35· CVE-2022-48367, GHSA-5x4f-7xgq-r42xAccess control issue in ezsystems/ezpublish-kernel
Modified: 9/10/2026
HIGHPackagist
GHSA-mrvj-7q4f-5p42· CVE-2021-46875Cross-site scripting in eZ Platform Kernel
Modified: 5/4/2026
HIGH7.2Packagist
GHSA-qq2j-9pf8-g58c· CVE-2022-48365Company admin role gives excessive privileges in eZ Platform Ibexa
Modified: 3/4/2025
CRITICALPackagist
GHSA-xfqg-p48g-hh94Login timing attack in ezsystems/ezpublish-kernel
Modified: 2/4/2026
CRITICAL9.8Packagist
GHSA-xwv6-v7qx-f5jc· CVE-2022-25337Code injection in ezsystems/ezpublish-kernel
Modified: 11/8/2023