GCVE - cpe:2.3:a:ez:ez_publish:3.9.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ez:ez_publish:3.9.2:*:*:*:*:*:*:*

part: a version: 3.9.2 update: *

Vendor	Ez (`7b59e160-3d8c-59e2-a2ad-e6730c6f4258`)
Product	Ez Publish (`ab65bf08-1558-5993-86c6-e15315a496e6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/ezsystems/ezpublish-kernel`	purl2cpe	2026-06-01 10:12:39.082080
`pkg:github/ezsystems/ezpublish-legacy`	purl2cpe	2026-06-01 10:12:39.082081

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2008-6844`	vulnerable	2026-06-08 04:51:04.953856	Details available The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters. Published: 2009-07-02T10:00:00.000Z Updated: 2024-08-07T11:42:00.867Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/47216 http://www.osvdb.org/52708 http://www.securityfocus.com/bid/32762 http://ez.no/developer/security/security_advisories/ez_publish_4_0/ezsa_2008_003_insufficient_form_handling_made_privilege_escalation_possible https://www.exploit-db.com/exploits/7406	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4494`	vulnerable	2026-06-08 04:49:56.410508	Details available The tipafriend function in eZ publish before 3.8.9, and 3.9 before 3.9.3, does not limit access by anonymous users, which allows remote attackers to conduct spam attacks. Published: 2007-08-23T01:00:00.000Z Updated: 2024-08-07T15:01:08.405Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_8_to_3_8_9 http://ez.no/community/news/ez_publish_security_fixes_3_9_3_and_3_8_9 http://www.securityfocus.com/bid/25538 http://secunia.com/advisories/26686 http://osvdb.org/40325	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-4493`	vulnerable	2026-06-08 04:49:56.409995	Details available eZ publish before 3.8.9, and 3.9 before 3.9.3, does not properly check permissions on module views that lack a policy function, which has unknown impact and attack vectors, as demonstrated by a vulnerability in the discount functionality in the shop module. Published: 2007-08-23T01:00:00.000Z Updated: 2024-08-07T15:01:09.444Z Open on db.gcve.eu Reference links http://ez.no/download/ez_publish/changelogs/ez_publish_3_8/changelog_3_8_8_to_3_8_9 http://ez.no/community/news/ez_publish_security_fixes_3_9_3_and_3_8_9 http://www.securityfocus.com/bid/25539 http://secunia.com/advisories/26686 http://osvdb.org/40324	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.