{"kind": "product", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "name": "ezsystems/ezpublish-legacy", "product": "ezsystems/ezpublish-legacy", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-38739", "noindex": false, "published": "2026-05-29T19:07:38Z", "modified": "2026-09-10T03:50:47.968897146Z", "cvss": 7.1, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-38739", "title": "ezsystems/ezpublish-legacy has a SQL injection in dfscleanup", "description": "NB: All tags and branches in this repository are past their end of life, so the vulnerability will not be fixed. The advisory is posted on the request of the researcher, for the information of anyone who might still use this software.\n\n### Impact\nThere is a security vulnerability in eZ Publish Legacy, affecting the dfscleanup.php script and the `_getFileList` function of the `eZDFSFileHandlerMySQLiBackend` class (kernel/private/classes/clusterfilehandlers/dfsbackends/mysqli.php). The vulnerability allows an attacker with local shell access and sufficient privileges to run dfscleanup.php to perform a union-based SQL injection against the eZ Pu", "references": ["https://github.com/ezsystems/ezpublish-legacy/security/advisories/GHSA-xg9x-h37w-h3r3", "https://github.com/ezsystems/ezpublish-legacy", "https://osv.dev/vulnerability/GHSA-xg9x-h37w-h3r3"], "fixes": [], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}, {"id": "GHSA-39j2-4p9j-5w4j", "noindex": false, "published": "2024-05-15T21:32:29Z", "modified": "2024-11-29T05:26:35.611726Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-39j2-4p9j-5w4j", "title": "Ez Platform Object Injection in legacy shop module", "description": "This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.", "references": ["https://ezplatform.com/security-advisories/ibexa-sa-2020-006-object-injection-in-legacy-shop-module", "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2020-10-05-1.yaml", "https://github.com/ezsystems/ezpublish-legacy"], "fixes": ["2017.12.7.3", "2019.3.5.1", "5.4.14.2"], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}, {"id": "GHSA-9895-26wr-4fgv", "noindex": false, "published": "2024-05-15T21:32:03Z", "modified": "2024-11-29T05:40:10.426761Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-9895-26wr-4fgv", "title": "EZsystems Remote code execution in file uploads", "description": "This Security Advisory is about a vulnerability in the way eZ Platform and eZ Publish Legacy handles file uploads, which can in the worst case lead to remote code execution (RCE), a very serious threat. An attacker would need access to uploading files to be able to exploit the vulnerability, so if you have strict controls on this and trust all who have this permission, you're not affected. On the basis of the tests we have made, we also believe the vulnerability cannot be exploited as long as our recommended vhost configuration is used. Here is the v2.5 recommendation for Nginx, as an example:\n\nhttps://github.com/ezsystems/ezplatform/blob/2.5", "references": ["https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads", "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2020-03-03-1.yaml", "https://github.com/ezsystems/ezpublish-legacy"], "fixes": ["2017.12.7.2", "2019.3.4.2", "5.4.14.1"], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}, {"id": "GHSA-pqjm-xcp8-wgmm", "noindex": false, "published": "2024-05-15T21:31:07Z", "modified": "2024-11-29T05:44:57.691639Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-pqjm-xcp8-wgmm", "title": "Ez Platform and Legacy are prone to an insecure interpretation of PHP/PHAR uploads", "description": "The eZ Platform and Legacy are affected by an issue related to how uploaded PHP and PHAR files are handled, and consists of two parts: 1. Web server configuration, and 2. Disabling the PHAR stream wrapper.\n\n**1. WEB SERVER CONFIGURATION**\nThe sample web server configuration in our documentation can in some cases allow the execution of uploaded PHP/PHAR code. This can be abused to allow priviledge escalation and breach of content access controls, among other things. Please ensure that your web server will not execute files in directories were files may be uploaded, such as web/var/ and ezpublish_legacy/var/\n\nAs an example, here is how you can ", "references": ["https://github.com/ezsystems/ezplatform/commit/9a0c52dc4535e4b3ce379f80222dc53f705a2cfd", "https://github.com/ezsystems/ezpublish-legacy/commit/d21957bf202b091ab39dfb5be300f6c30be3933e", "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-11-21-1.yaml"], "fixes": ["2017.12.4.3", "2018.6.1.4", "2018.9.1.3", "5.3.12.6", "5.4.12.3"], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}, {"id": "GHSA-p9mp-vq4v-v5m5", "noindex": false, "published": "2024-05-15T21:30:03Z", "modified": "2024-11-29T05:34:29.973209Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-p9mp-vq4v-v5m5", "title": "eZ Publish Legacy Passwordless login for LDAP users", "description": "This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy.\n\nInstallations that are using the legacy LDAP login handler or the TextFile login handler in combination with the standard legacy login handler, may in rare cases be vulnerable to a failure of the standard login handler to verify passwords correctly, allowing unauthorised access.\n\nIf your installation has never used the LDAP or TextFile login handlers, or never used legacy login at all, then it is not affected. Still, we recommend installing the update, to be on the safe side.\n\nTo install, use Co", "references": ["https://github.com/ezsystems/ezpublish-legacy/pull/1394", "https://github.com/ezsystems/ezpublish-legacy/commit/01930a95637389301f762be1439f726013e58aba", "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-10-31-1.yaml"], "fixes": ["2017.12.4.1", "2018.6.1.2", "2018.9.1.1", "5.3.12.4", "5.4.12.1"], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}, {"id": "GHSA-2vh3-cj9j-mcj5", "noindex": false, "published": "2024-05-15T21:29:15Z", "modified": "2024-11-29T05:34:13.006366Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-2vh3-cj9j-mcj5", "title": "eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template", "description": "This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy via the LegacyBridge.\n\nInstallations where all modules are disabled may be vulnerable to XSS injection in the module name. This is a rare configuration, but we still recommend installing the update, which adds the necessary input washing.\n\nTo install, use Composer to update to one of the \"Resolving versions\" mentioned above, or apply this patch manually:\nhttps://github.com/ezsystems/ezpublish-legacy/commit/4697bff700e8cf95d5847ea19dad3479a77b02d9", "references": ["https://github.com/ezsystems/ezpublish-legacy/commit/4697bff700e8cf95d5847ea19dad3479a77b02d9", "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2018-11-01-1.yaml", "https://github.com/ezsystems/ezpublish-legacy"], "fixes": ["2017.12.4.2", "2018.6.1.3", "2018.9.1.2", "5.3.12.5", "5.4.12.2"], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}, {"id": "GHSA-82rv-45pc-v28w", "noindex": false, "published": "2024-05-15T21:22:03Z", "modified": "2024-11-29T05:40:34.589155Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-82rv-45pc-v28w", "title": "eZ Publish Legacy Patch EZSA-2018-001 for Several vulnerabilities", "description": "This security advisory fixes 4 separate vulnerabilities in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy by itself or via the LegacyBridge.\n \nFirst, it increases the randomness, and thus the security, of the pseudo-random bytes used to generate a hash for the \"forgot password\" feature. This protects accounts against being taken over through attacks trying to predict the hash. If the increased randomness is not available in your PHP installation, it will now log a warning.\n \nSecond, it improves security of the information collector feature, by ensuring no collection emails will be sent from", "references": ["https://github.com/ezsystems/ezpublish-legacy/commit/6db0e6b7739481f27d954548388bd3f0ed2c6fdd", "https://github.com/ezsystems/ezpublish-legacy/commit/917711eb7ffe2b52a3e9fe12505f6810a63696f7", "https://github.com/ezsystems/ezpublish-legacy/commit/efcd2b61b15eaaf74e0ff28d6c723cf28e655dab"], "fixes": ["2017.12.2.1", "5.3.12.3", "5.4.11.3"], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}, {"id": "GHSA-cc2j-92jq-wgjg", "noindex": false, "published": "2024-05-15T21:21:09Z", "modified": "2024-11-29T05:41:44.906496Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-cc2j-92jq-wgjg", "title": "eZ Publish Information disclosure in backend content tree menu", "description": "This security advisory fixes an information disclosure vulnerability in the legacy admin content tree menu. If a view has been disabled in site.ini [SiteAccessRules] Rules, and an attacker accesses the backend with the URL to this module, then the tree menu may be displayed. Since the tree menu may contain hidden items, this may lead to information disclosure. We recommend that you install this Security Update as soon as possible.\n\nTo install, use Composer to update to one of the \"Resolving versions\" mentioned above, or apply this patch manually: https://github.com/ezsystems/ezpublish-legacy/commit/a4a0470f8d80f012fe14e4f8ab11c7d14375986c\n\n", "references": ["https://github.com/ezsystems/ezpublish-legacy/commit/a4a0470f8d80f012fe14e4f8ab11c7d14375986c", "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2017-09-11-1.yaml", "https://github.com/ezsystems/ezpublish-legacy"], "fixes": ["2017.8.1.1", "5.3.12.2", "5.4.10.1"], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}, {"id": "GHSA-jpwx-ffjq-wr4w", "noindex": false, "published": "2021-09-07T22:54:23Z", "modified": "2024-12-02T05:54:42.708773Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-jpwx-ffjq-wr4w", "title": "Content object state fetch functions open to SQL injection", "description": "### Impact\nThis Security Update is about a vulnerability in eZ Publish Legacy. The content object state code could be vulnerable to SQL injection. There is no known exploit, but one might be possible. If you use Legacy in any way, we strongly recommend that you install this update as soon as possible.\n\n### Patches\nThe fix is distributed via Composer, see \"Patched versions\".\n\n", "references": ["https://github.com/ezsystems/ezpublish-legacy/security/advisories/GHSA-jpwx-ffjq-wr4w", "https://github.com/ezsystems/ezpublish-legacy/commit/f8e3a97afd92efb9148134a4bacb35a875777a42", "https://developers.ibexa.co/security-advisories/ibexa-sa-2021-005-content-object-state-fetch-functions-open-to-sql-injection"], "fixes": ["2017.12.7.4", "2019.03.6.1"], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}, {"id": "CVE-2020-10806", "noindex": false, "published": "2020-03-22T15:34:08.000Z", "modified": "2024-08-04T11:14:15.514Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.0232, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2020-10806", "title": "CVE-2020-10806", "description": "eZ Publish Kernel before 5.4.14.1, 6.x before 6.13.6.2, and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1, 2017 before 2017.12.7.2, and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code, unless the vhost configuration permits only app.php execution.", "references": ["https://ezplatform.com/security-advisories/ezsa-2020-001-remote-code-execution-in-file-uploads", "https://nvd.nist.gov/vuln/detail/CVE-2020-10806"], "fixes": ["2017.12.7.2", "2019.03.4.2", "5.4.14.1"], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}, {"id": "CVE-2017-1000431", "noindex": false, "published": "2018-01-02T20:00:00.000Z", "modified": "2024-09-17T02:32:00.162Z", "cvss": 6.1, "cvss_vector": "", "severity": "medium", "epss": 0.00679, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2017-1000431", "title": "CVE-2017-1000431", "description": "eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.", "references": ["http://share.ez.no/community-project/security-advisories/ezsa-2017-005-xss-issue-in-search", "https://nvd.nist.gov/vuln/detail/CVE-2017-1000431"], "fixes": ["5.3.12.1", "5.4.10"], "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}, {"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}]}], "total": 11, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "ezsystems/ezpublish-legacy", "path": "vulns/packagist/ezsystems%2Fezpublish-legacy", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-10T03:50:47.968897146Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}