CVE-2010-2672

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-07-08 · updated 2026-06-16
Weakness: CWE-89

Description

Multiple SQL injection vulnerabilities in eZ Publish 3.7.0 through 4.2.0 allow remote attackers to execute arbitrary SQL commands via the (1) SectionID and (2) SearchTimestamp parameters to the search feature and the (3) SearchContentClassAttributeID parameter to the advancedsearch feature.

Affected products

Ez Publish: 3.7.0, 3.7.1, 3.7.2, 3.7.3, 3.7.4, 3.7.5 (+8)

References

http://ez.no/de/content/download/321165/3192248/version/1/file/16397.diff
http://ez.no/de/content/download/321166/3192253/version/1/file/16398.diff
http://ez.no/de/developer/security/security_advisories/ez_publish_4_2/ezsa_2010_001_remote_vulnerability_in_ez_search
http://osvdb.org/63237
http://osvdb.org/63238
http://secunia.com/advisories/39101
http://www.securityfocus.com/bid/38985
http://www.siberas.de/advisories/advisories_2010.html
http://ez.no/de/content/download/321165/3192248/version/1/file/16397.diff
http://ez.no/de/content/download/321166/3192253/version/1/file/16398.diff
http://ez.no/de/developer/security/security_advisories/ez_publish_4_2/ezsa_2010_001_remote_vulnerability_in_ez_search
http://osvdb.org/63237

Get alerted when CVE-2010-2672 or the next vulnerability affects your stack