GCVE - cpe:2.3:a:ez:ez_publish:3.6.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ez:ez_publish:3.6.5:*:*:*:*:*:*:*

part: a version: 3.6.5 update: *

Vendor	Ez (`7b59e160-3d8c-59e2-a2ad-e6730c6f4258`)
Product	Ez Publish (`ab65bf08-1558-5993-86c6-e15315a496e6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/ezsystems/ezpublish-kernel`	purl2cpe	2026-06-01 10:12:39.081957
`pkg:github/ezsystems/ezpublish-legacy`	purl2cpe	2026-06-01 10:12:39.081959

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2008-6844`	vulnerable	2026-06-08 04:51:04.948356	Details available The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters. Published: 2009-07-02T10:00:00.000Z Updated: 2024-08-07T11:42:00.867Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/47216 http://www.osvdb.org/52708 http://www.securityfocus.com/bid/32762 http://ez.no/developer/security/security_advisories/ez_publish_4_0/ezsa_2008_003_insufficient_form_handling_made_privilege_escalation_possible https://www.exploit-db.com/exploits/7406	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2006-0938`	vulnerable	2026-06-08 04:48:55.833060	Details available Cross-site scripting (XSS) vulnerability in eZ publish 3.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the RefererURL parameter. Published: 2006-03-01T02:00:00.000Z Updated: 2024-08-07T16:56:15.594Z Open on db.gcve.eu Reference links http://www.nukedx.com/?viewdoc=16 http://www.securityfocus.com/bid/16817 https://exchange.xforce.ibmcloud.com/vulnerabilities/24956 http://www.securityfocus.com/archive/1/426076/100/0/threaded http://securitytracker.com/id?1015683	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4854`	vulnerable	2026-06-08 04:48:45.365723	Details available eZ publish 3.5 through 3.7 before 20050830 does not use a folder's read permissions to restrict notifications, which allows remote authenticated users to obtain sensitive information about changes to content in arbitrary folders. Published: 2007-07-06T19:00:00.000Z Updated: 2024-09-17T01:21:28.680Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_6_x_3_7_x_to_3_8_0 http://issues.ez.no/6355	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.