GCVE - cpe:2.3:a:ez:ez_publish:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ez:ez_publish:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Ez (`7b59e160-3d8c-59e2-a2ad-e6730c6f4258`)
Product	Ez Publish (`ab65bf08-1558-5993-86c6-e15315a496e6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/ezsystems/ezpublish-kernel`	purl2cpe	2026-06-01 10:12:39.054100
`pkg:github/ezsystems/ezpublish-legacy`	purl2cpe	2026-06-01 10:12:39.054103

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-1000431`	vulnerable	2026-06-08 05:08:34.545045	Details available eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials. Published: 2018-01-02T20:00:00.000Z Updated: 2024-09-17T02:32:00.162Z Open on db.gcve.eu Reference links http://share.ez.no/community-project/security-advisories/ezsa-2017-005-xss-issue-in-search	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-6844`	vulnerable	2026-06-08 04:51:04.942291	Details available The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters. Published: 2009-07-02T10:00:00.000Z Updated: 2024-08-07T11:42:00.867Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/47216 http://www.osvdb.org/52708 http://www.securityfocus.com/bid/32762 http://ez.no/developer/security/security_advisories/ez_publish_4_0/ezsa_2008_003_insufficient_form_handling_made_privilege_escalation_possible https://www.exploit-db.com/exploits/7406	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4494`	vulnerable	2026-06-08 04:49:56.410447	Details available The tipafriend function in eZ publish before 3.8.9, and 3.9 before 3.9.3, does not limit access by anonymous users, which allows remote attackers to conduct spam attacks. Published: 2007-08-23T01:00:00.000Z Updated: 2024-08-07T15:01:08.405Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_8_to_3_8_9 http://ez.no/community/news/ez_publish_security_fixes_3_9_3_and_3_8_9 http://www.securityfocus.com/bid/25538 http://secunia.com/advisories/26686 http://osvdb.org/40325	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4493`	vulnerable	2026-06-08 04:49:56.407755	Details available eZ publish before 3.8.9, and 3.9 before 3.9.3, does not properly check permissions on module views that lack a policy function, which has unknown impact and attack vectors, as demonstrated by a vulnerability in the discount functionality in the shop module. Published: 2007-08-23T01:00:00.000Z Updated: 2024-08-07T15:01:09.444Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_8_to_3_8_9 http://ez.no/community/news/ez_publish_security_fixes_3_9_3_and_3_8_9 http://www.securityfocus.com/bid/25539 http://secunia.com/advisories/26686 http://osvdb.org/40324	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-7219`	vulnerable	2026-06-08 04:49:30.578745	Details available eZ publish before 3.8.5 does not properly enforce permissions for editing in a specific language, which allows remote authenticated users to create a draft in an unauthorized language by editing an archived version of an object, and then using Manage Versions to copy this version to a new draft. Published: 2007-07-06T19:00:00.000Z Updated: 2024-09-16T22:03:07.625Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_4_to_3_8_5 http://issues.ez.no/8795 http://ez.no/download/ez_publish/changelogs/ez_publish_3_9/changelog_3_8_0_to_3_9_0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-7218`	vulnerable	2026-06-08 04:49:30.578376	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0938`	vulnerable	2026-06-08 04:48:55.827070	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4857`	vulnerable	2026-06-08 04:48:45.379614	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4856`	vulnerable	2026-06-08 04:48:45.379029	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4855`	vulnerable	2026-06-08 04:48:45.376942	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4852`	vulnerable	2026-06-08 04:48:45.353827	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4851`	vulnerable	2026-06-08 04:48:45.353567	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4850`	vulnerable	2026-06-08 04:48:45.353221	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.