← Back

Ibexa

ibexa

10 CVEs • 12 products

Products (12)

Click to collapse
Toggle
Ez Platform Kernel
ez_platform_kernel
7 CVEs
Digital Experience Platform
digital_experience_platform
3 CVEs
Ez Platform
ez_platform
3 CVEs
Kernel
kernel
2 CVEs
Ezplatform Graphql
ezplatform-graphql
1 CVE
Commerce
commerce
1 CVE
Ezplatform Page Builder
ezplatform-page-builder
1 CVE
Jmspaymentcorebundle
jmspaymentcorebundle
1 CVE
Ezplatform Http Cache Fastly
ezplatform-http-cache-fastly
1 CVE
Fastly
fastly
1 CVE
Ezpublish Legacy
ezpublish_legacy
1 CVE
Ezpublish Platform
ezpublish_platform
1 CVE

CVEs (10)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-70363
1Ibexa
1Ez Platform
Jun 2, 2026
Mar 6, 2026
N/A· v4
7.5 HIGH· v3
N/A· v2
Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access sensitive data via enumerating object IDs.
CVE-2020-23065
1Ibexa
2Ezpublish Legacy
Ezpublish Platform
Nov 21, 2024
Jun 26, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attacker to execute arbitrary code via the video-js.swf.
CVE-2022-48367
1Ibexa
5Digital Experience Platform
Ez Platform KernelEzplatform Http Cache Fastly+2 more
Mar 4, 2025
Mar 12, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
CVE-2022-48366
1Ibexa
7Commerce
Digital Experience PlatformEz Platform+4 more
Mar 4, 2025
Mar 12, 2023
N/A· v4
3.7 LOW· v3
N/A· v2
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
CVE-2022-48365
1Ibexa
3Digital Experience Platform
Ez PlatformEz Platform Kernel
Mar 4, 2025
Mar 12, 2023
N/A· v4
7.2 HIGH· v3
N/A· v2
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
CVE-2021-46876
1Ibexa
1Ez Platform Kernel
Mar 5, 2025
Mar 12, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1. The /user/sessions endpoint can be abused to determine account existence.
CVE-2021-46875
1Ibexa
1Ez Platform Kernel
Mar 4, 2025
Mar 12, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1. An XSS attack can occur because JavaScript code can be uploaded in a .html or .js file.
CVE-2022-41876
1Ibexa
1Ezplatform Graphql
Nov 21, 2024
Nov 10, 2022
N/A· v4
5.3 MEDIUM· v3
N/A· v2
ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for...Show more
ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source. Versions prior to 2.3.12 and 1.0.13 are subject to Insecure Storage of Sensitive Information. Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically administrators and editors. This issue has been patched in versions 2.3.12, and 1.0.13 on the 1.X branch. Users unable to upgrade can remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.Show less
CVE-2022-25337
1Ibexa
1Ez Platform Kernel
Nov 21, 2024
Feb 18, 2022
N/A· v4
9.8 CRITICAL· v3
6.8 MEDIUM· v2
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.
CVE-2022-25336
1Ibexa
1Ez Platform Kernel
Nov 21, 2024
Feb 18, 2022
N/A· v4
5.3 MEDIUM· v3
4.3 MEDIUM· v2
Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.