ezsystems/ezpublish-legacy Security Advisories (11)
-
[HIGH] ezsystems/ezpublish-legacy has a SQL injection in dfscleanup
PKSA-vrcj-tzjw-khtt CVE-2026-38739 GHSA-xg9x-h37w-h3r3
Affected version: =2019.03
Reported by:
GitHub -
[HIGH] eZ Publish Information disclosure in backend content tree menu
PKSA-z8zn-1svn-qf72 GHSA-cc2j-92jq-wgjg
Affected version: >=5.3.0,<5.3.12.2|>=5.4.0,<5.4.10.1|>=2011.0.0,<2017.8.1.1
Reported by:
GitHub -
[CRITICAL] eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type
PKSA-x1cq-96j3-vfs9 CVE-2020-10806 GHSA-54p5-gxq6-j98g
Affected version: >=2019,<2019.03.4.2|>=2017,<2017.12.7.2|<5.4.14.1
Reported by:
GitHub -
[HIGH] IBEXA-SA-2020-006 Object Injection in legacy shop module
PKSA-21zv-zmv6-8djw GHSA-82rv-45pc-v28w
Affected version: >=2019.3.0,<2019.3.5.1|>=2017.12.0,<2017.12.7.3|>=5.4.0,<5.4.14.2
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[HIGH] EZSA-2020-001 Remote code execution in file uploads
PKSA-8zqw-67xm-djp1 GHSA-p9mp-vq4v-v5m5
Affected version: >=2019.3.0,<2019.3.4.2|>=2017.12.0,<2017.12.7.2|>=5.4.0,<5.4.14.1
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[HIGH] EZSA-2018-009 Do not interpret PHP/PHAR uploads
PKSA-pyck-srww-rjvt GHSA-9895-26wr-4fgv
Affected version: >=2018.9.0,<2018.9.1.3|>=2018.6.0,<2018.6.1.4|>=2011.0.0,<2017.12.4.3|>=5.4.0,<5.4.12.3|>=5.3.0,<5.3.12.6
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[HIGH] EZSA-2018-006 XSS vulnerability in 'disabled module' error template
PKSA-n31w-wzc4-zw3b GHSA-jpwx-ffjq-wr4w
Affected version: >=2018.9.0,<2018.9.1.2|>=2018.6.0,<2018.6.1.3|>=2011.0.0,<2017.12.4.2|>=5.4.0,<5.4.12.2|>=5.3.0,<5.3.12.5
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[MEDIUM] EZSA-2018-005 Passwordless login for LDAP users
PKSA-4hqb-7wxf-8qrs GHSA-2vh3-cj9j-mcj5
Affected version: >=2018.9.0,<2018.9.1.1|>=2018.6.0,<2018.6.1.2|>=2011.0.0,<2017.12.4.1|>=5.4.0,<5.4.12.1|>=5.3.0,<5.3.12.4
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[MEDIUM] EZSA-2018-001 Several vulnerabilities in Forgot password, Information collector, XML text, and Matrix field type features
PKSA-12d4-fcmc-ws8v GHSA-39j2-4p9j-5w4j
Affected version: >=2011.0.0,<2017.12.2.1|>=5.4.0,<5.4.11.3|>=5.3.0,<5.3.12.3
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[MEDIUM] EZSA-2017-006 Information disclosure in backend content tree menu
PKSA-h4ds-xj4t-xwqp GHSA-pqjm-xcp8-wgmm
Affected version: >=2011.0.0,<2017.8.1.1|>=5.4.0,<5.4.10.1|>=5.3.0,<5.3.12.2
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[MEDIUM] EZSA-2017-005 XSS issue in search
PKSA-9ds2-tbc5-tk1z CVE-2017-1000431 GHSA-m98q-p5gq-q5ff
Affected version: >=5.4.0,<5.4.10|>=5.3.0,<5.3.12.1
Reported by:
FriendsOfPHP/security-advisories, GitHub