ibexa

Records14All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high5CVSS 7.0–8.9

Exploited now

ibexa records in CISA KEV

No ibexa vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Ez Platform Kernel 7 records MEDIUM Digital Experience Platform 3 records MEDIUM Ez Platform 3 records LOW Kernel 2 records MEDIUM Commerce 1 record LOW Ezplatform-graphql 1 record MEDIUM Ezplatform-http-cache-fastly 1 record MEDIUM Ezplatform-page-builder 1 record LOW

Records

14 records

TI-2022-23981 CVE-2022-48367 · GHSA-h5v2-wrhp-5v35

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28.

MEDIUM 50

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00721 Published 2023-03-12 Fixed in 7.5.28 CWE-862

TI-2022-09029 CVE-2022-25337 · GHSA-xwv6-v7qx-f5jc

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows…

MEDIUM 44

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows injection attacks via image filenames.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01059 Published 2022-02-18 Fixed in 7.5.26 CWE-74

TI-2022-20217 CVE-2022-41876 · GHSA-c7pc-pgf6-mfh5

ezplatform-graphql GraphQL queries can expose password hashes

MEDIUM 42

ezplatform-graphql is a GraphQL server implementation for Ibexa DXP and Ibexa Open Source.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0164 Published 2022-11-10 Fixed in 1.0.13, 2.3.12 CWE-200

TI-2025-43106 CVE-2025-70363 · GHSA-frjw-grrr-vrpr

Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril…

LOW 39

Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access sensitive data via enumerating object IDs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00278 Published 2026-03-06 No fix listed CWE-284

TI-2025-41415 CVE-2025-67719 · GHSA-x93p-w2ch-fg67

Ibexa User Bundle is missing password change validation

LOW 38

Ibexa is a composable end-to-end DXP (Digital Experience Platform).

CVSS 4.0HIGH 8.5 Local No auth No interaction EPSS 0.00141 Published 2025-12-11 Fixed in 5.0.4 CWE-620

TI-2024-29020 CVE-2024-43369 · GHSA-hvcf-6324-cjh7

Persistent Cross-site Scripting in Ibexa RichText Field Type

LOW 38

Ibexa RichText Field Type is a Field Type for supporting rich formatted text stored in a structured XML format.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00367 Published 2024-08-15 Fixed in 4.6.10 CWE-79

TI-2022-23979 CVE-2022-48365 · GHSA-qq2j-9pf8-g58c

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26.

LOW 35

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00862 Published 2023-03-12 Fixed in 7.5.30, 1.3.26 CWE-269

TI-2021-21544 CVE-2021-46876 · GHSA-gmrf-99gw-vvwj

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1.

LOW 31

An issue was discovered in eZ Publish Ibexa Kernel before 7.5.15.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00507 Published 2023-03-12 Fixed in 6.13.8.1, 7.5.15.1 CWE-203

TI-2021-21543 CVE-2021-46875 · GHSA-mrvj-7q4f-5p42

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1.

LOW 27

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.1.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00398 Published 2023-03-12 Fixed in 6.13.8.2, 7.5.15.2 +2 CWE-79

TI-2024-36057 CVE-2024-53864 · GHSA-8w3p-gf85-qcch

Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui

LOW 25

Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00532 Published 2024-11-29 Fixed in 4.6.14 CWE-79

TI-2024-26274 CVE-2024-39318 · GHSA-qm44-wjm2-pr59

Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget

LOW 25

The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00385 Published 2024-07-31 Fixed in 4.6.9 CWE-79

TI-2022-09028 CVE-2022-25336 · GHSA-x8xx-x82q-42q3

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows…

LOW 25

Ibexa DXP ezsystems/ezpublish-kernel 7.5.x before 7.5.26 and 1.3.x before 1.3.12 allows Insecure Direct Object Reference (IDOR) attacks against image files because the image path and filename can be correctly deduced.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00707 Published 2022-02-18 Fixed in 1.3.12 CWE-639

TI-2020-14454 CVE-2020-23065 · GHSA-5xj2-4x83-fmx6

Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ…

LOW 25

Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attacker to execute arbitrary code via the video-js.swf.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00492 Published 2023-06-26 No fix listed CWE-79

TI-2022-23980 CVE-2022-48366 · GHSA-66m4-gc8h-hpjx

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19.

LOW 18

An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00458 Published 2023-03-12 Fixed in 1.3.19, 7.5.29 CWE-362

Open these records in search →

Critical	2
High	5
Medium	6
Low	1
No CVSS	0