CVE-2010-2672
ez ez publish: no CVSS score yet. EPSS 1.3% chance of exploitation in the next 30 days.
Multiple SQL injection vulnerabilities in eZ Publish 3.7.0 through 4.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) SectionID and (2) SearchTimestamp parameters to the search feature and the (3) SearchContentClassAttributeID parameter to the advancedsearch feature.
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ez:ez_publish
References
- http://ez.no/de/content/download/321165/3192248/version/1/file/16397.diff
- http://ez.no/de/content/download/321166/3192253/version/1/file/16398.diff
- http://ez.no/de/developer/security/security_advisories/ez_publish_4_2/ezsa_2010_001_remote_vulnerability_in_ez_search
- http://osvdb.org/63237
- http://osvdb.org/63238