4 results · Clear filters · Feed
-
Medium —
ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal
### Impact This security advisory resolves an XSS vulnerability in image asset names, content language names and future publishing in the back office of the DXP. Back office access and varying levels of editing and management permissions are required to explo…
-
Medium —
Ibexa Admin UI XSS vulnerabilities in back office
### Impact This security advisory is a part of IBEXA-SA-2025-003, which resolves XSS vulnerabilities in several parts of the back office of Ibexa DXP. Back office access and varying levels of editing and management permissions are required to exploit these vu…
-
Medium 5.3
Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui
Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is req…
-
Medium 5.4
Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget
The Ibexa Admin UI Bundle contains all the necessary parts to run the Ibexa DXP Back Office interface. The file upload widget is vulnerable to XSS payloads in filenames. Access permission to upload files is required. As such, in most cases only authenticated …