Ibexa vulnerabilities

Products

• Ez Platform Kernel 7
• Digital Experience Platform 4
• Ez Platform 3
• Admin-ui 2
• Kernel 2

Newest

• ibexa ez platform Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x... CVE-2025-70363 7.5 HighMarch 6, 2026
• ibexa user Ibexa User Bundle is missing password change validation CVE-2025-67719 Fix available 8.5 HighDecember 10, 2025
• ibexa admin-ui Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui CVE-2024-53864 Fix available 5.3 MediumNovember 29, 2024
• ibexa ezplatform-richtext, fieldtype-richtext +1 more Persistent Cross-site Scripting in Ibexa RichText Field Type CVE-2024-43369 Fix available 7.2 HighAugust 14, 2024
• ibexa admin-ui Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget CVE-2024-39318 Fix available 5.4 MediumJuly 31, 2024
• liferay dxp, portal, ibexa digital experience platform +1 more +3 more Liferay Portal and Liferay DXP User Enumeration Vulnerability CVE-2024-26268 Fix available 5.3 MediumFebruary 20, 2024
• ibexa ezpublish platform, ezpublish legacy +1 more Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish... CVE-2020-23065 5.4 MediumJune 26, 2023
• ibexa ez platform, kernel, commerce +4 more +6 more Timing attack in eZ Platform Ibexa CVE-2022-48366 Fix available 3.7 LowMarch 12, 2023
• ibexa ez platform, digital experience platform, ez platform kernel +2 more Company admin role gives excessive privileges in eZ Platform Ibexa CVE-2022-48365 Fix available 7.2 HighMarch 12, 2023
• ezsystems ezplatform-graphql ezplatform-graphql GraphQL queries can expose password hashes CVE-2022-41876 Public exploitFix available 7.5 HighNovember 10, 2022
• ibexa kernel, digital experience platform, ez platform kernel +2 more +4 more Object state limitation has no effect CVE-2022-48367 Fix available 9.8 CriticalApril 29, 2022
• ibexa ez platform kernel Exposure of Resource to Wrong Sphere in ezsystems/ezplatform-kernel CVE-2022-25336 Fix available 5.3 MediumFebruary 18, 2022
• ibexa ez platform kernel Code injection in ezsystems/ezpublish-kernel CVE-2022-25337 Fix available 9.8 CriticalFebruary 18, 2022
• ibexa ez platform kernel Duplicate Advisory: Cross Site Scripting in eZ Platform Ibexa Kernel CVE-2021-46875 Fix available 6.1 MediumMarch 19, 2021
• ibexa ez platform kernel Duplicate Advisory: User account enumeration in eZ Publish Ibexa Kernel CVE-2021-46876 Fix available 5.3 MediumMarch 11, 2021