Composer ezsystems/ezpublish-legacy has 18 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2020-10806 | eZ Publish Kernel and Legacy Unrestricted Upload of File with Dangerous Type | critical | 9.8 | <5.4.14.1 or >=2017 and <2017.12.7.2 or >=2019 and <2019.03.4.2 | 5.4.14.1, 2017.12.7.2, 2019.03.4.2 |
| CVE-2017-1000431 | eZ Publish Cross-site Scripting (XSS) vulnerability | medium | 6.1 | >=5.4.0 and <5.4.10 or >=5.3.0 and <5.3.12.1 | 5.4.10, 5.3.12.1 |
| CVE-2026-38739 | ezsystems/ezpublish-legacy has a SQL injection in dfscleanup | high | 7.1 | =2019.03 | – |
| 2017-09-11-1 | EZSA-2017-006 Information disclosure in backend content tree menu | unknown | 0.0 | >=2011.0.0 and <2017.8.1.1 or >=5.4.0 and <5.4.10.1 or >=5.3.0 and <5.3.12.2 | 2017.8.1.1, 5.4.10.1, 5.3.12.2 |
| 2018-02-26-1 | EZSA-2018-001 Several vulnerabilities in Forgot password, Information collector, XML text, and Matrix field type features | unknown | 0.0 | >=2011.0.0 and <2017.12.2.1 or >=5.4.0 and <5.4.11.3 or >=5.3.0 and <5.3.12.3 | 2017.12.2.1, 5.4.11.3, 5.3.12.3 |
| 2018-10-31-1 | EZSA-2018-005 Passwordless login for LDAP users | unknown | 0.0 | >=2018.9.0 and <2018.9.1.1 or >=2018.6.0 and <2018.6.1.2 or >=2011.0.0 and <2017.12.4.1 or >=5.4.0 and <5.4.12.1 or >=5.3.0 and <5.3.12.4 | 2018.9.1.1, 2018.6.1.2, 2017.12.4.1, 5.4.12.1 |
| 2018-11-01-1 | EZSA-2018-006 XSS vulnerability in 'disabled module' error template | unknown | 0.0 | >=2018.9.0 and <2018.9.1.2 or >=2018.6.0 and <2018.6.1.3 or >=2011.0.0 and <2017.12.4.2 or >=5.4.0 and <5.4.12.2 or >=5.3.0 and <5.3.12.5 | 2018.9.1.2, 2018.6.1.3, 2017.12.4.2, 5.4.12.2 |
| 2018-11-21-1 | EZSA-2018-009 Do not interpret PHP/PHAR uploads | unknown | 0.0 | >=2018.9.0 and <2018.9.1.3 or >=2018.6.0 and <2018.6.1.4 or >=2011.0.0 and <2017.12.4.3 or >=5.4.0 and <5.4.12.3 or >=5.3.0 and <5.3.12.6 | 2018.9.1.3, 2018.6.1.4, 2017.12.4.3, 5.4.12.3 |
| 2020-03-03-1 | EZSA-2020-001 Remote code execution in file uploads | unknown | 0.0 | >=2019.3.0 and <2019.3.4.2 or >=2017.12.0 and <2017.12.7.2 or >=5.4.0 and <5.4.14.1 | 2019.3.4.2, 2017.12.7.2, 5.4.14.1 |
| 2020-10-05-1 | IBEXA-SA-2020-006 Object Injection in legacy shop module | unknown | 0.0 | >=2019.3.0 and <2019.3.5.1 or >=2017.12.0 and <2017.12.7.3 or >=5.4.0 and <5.4.14.2 | 2019.3.5.1, 2017.12.7.3, 5.4.14.2 |
| GHSA-2vh3-cj9j-mcj5 | eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template | medium | 0.0 | >=2018.9.0 and <2018.9.1.2 or >=2018.6.0 and <2018.6.1.3 or >=2011.0.0 and <2017.12.4.2 or >=5.4.0 and <5.4.12.2 or >=5.3.0 and <5.3.12.5 | 2018.9.1.2, 2018.6.1.3, 2017.12.4.2, 5.4.12.2 |
| GHSA-39j2-4p9j-5w4j | Ez Platform Object Injection in legacy shop module | medium | 0.0 | >=2019.3.0 and <2019.3.5.1 or >=2017.12.0 and <2017.12.7.3 or >=5.4.0 and <5.4.14.2 | 2019.3.5.1, 2017.12.7.3, 5.4.14.2 |
| GHSA-82rv-45pc-v28w | eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilities | high | 0.0 | >=2011.0.0 and <2017.12.2.1 or >=5.4.0 and <5.4.11.3 or >=5.3.0 and <5.3.12.3 | 2017.12.2.1, 5.4.11.3, 5.3.12.3 |
| GHSA-9895-26wr-4fgv | EZsystems Remote code execution in file uploads | high | 0.0 | >=2019.3.0 and <2019.3.4.2 or >=2017.12.0 and <2017.12.7.2 or >=5.4.0 and <5.4.14.1 | 2019.3.4.2, 2017.12.7.2, 5.4.14.1 |
| GHSA-cc2j-92jq-wgjg | eZ Publish Information disclosure in backend content tree menu | high | 0.0 | >=2011.0.0 and <2017.8.1.1 or >=5.4.0 and <5.4.10.1 or >=5.3.0 and <5.3.12.2 | 2017.8.1.1, 5.4.10.1, 5.3.12.2 |
| GHSA-jpwx-ffjq-wr4w | Content object state fetch functions open to SQL injection | high | 0.0 | >=2018.06.0 and <2019.03.6.1 or <2017.12.7.4 | 2019.03.6.1, 2017.12.7.4 |
| GHSA-p9mp-vq4v-v5m5 | eZ Publish Legacy Passwordless login for LDAP users | high | 0.0 | >=2018.9.0 and <2018.9.1.1 or >=2018.6.0 and <2018.6.1.2 or >=2011.0.0 and <2017.12.4.1 or >=5.4.0 and <5.4.12.1 or >=5.3.0 and <5.3.12.4 | 2018.9.1.1, 2018.6.1.2, 2017.12.4.1, 5.4.12.1 |
| GHSA-pqjm-xcp8-wgmm | Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploads | medium | 0.0 | >=2018.9.0 and <2018.9.1.3 or >=2018.6.0 and <2018.6.1.4 or >=2011.0.0 and <2017.12.4.3 or >=5.4.0 and <5.4.12.3 or >=5.3.0 and <5.3.12.6 | 2018.9.1.3, 2018.6.1.4, 2017.12.4.3, 5.4.12.3 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked