Pimcore vulnerabilities

Products

• Pimcore 145
• Pimcore/pimcore 79
• Admin Classic Bundle 14
• Admin-ui-classic-bundle 12
• Customer Management Framework 9
• Customer-data-framework 7
• Pimcore/customer-data-framework 5

Newest

• pimcore Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview CVE-2026-109392 5.1 MediumOctober 12, 2026
• pimcore Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization CVE-2026-55416 Fix available 8.8 HighSeptember 10, 2026
• pimcore Pimcore: Remote Code Execution via DataObject Class-Definition Field Name CVE-2026-55634 Fix available 9.9 CriticalAugust 28, 2026
• pimcore Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column CVE-2026-55220 Fix available 9.3 CriticalAugust 28, 2026
• pimcore Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name CVE-2026-55072 Fix available 8.5 HighAugust 13, 2026
• pimcore admin-ui-classic-bundle Pimcore pimcore admin-ui-classic-bundle - SQL Injection CVE-2026-72562 8.8 HighAugust 11, 2026
• pimcore Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass CVE-2026-55207 Fix available 8.8 HighJuly 9, 2026
• pimcore Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes CVE-2026-55208 Fix available 7.7 HighJuly 9, 2026
• pimcore Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation CVE-2026-55212 Fix available 7.1 HighJuly 9, 2026
• pimcore Pimcore: CustomReports Share Bypass CVE-2026-45704 Fix available 7.1 HighMay 27, 2026
• pimcore Pimcore: WordExport Authorization Bypass for Unauthorized Document Export CVE-2026-45703 Fix available 6.4 MediumMay 27, 2026
• pimcore Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling CVE-2026-45260 Fix available 8.1 HighMay 27, 2026
• pimcore Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction CVE-2026-45162 Fix available 8.0 HighMay 27, 2026
• pimcore Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter CVE-2026-44741 Fix available 8.8 HighMay 27, 2026
• pimcore Pimcore: SQL Injection in Custom Reports Column Configuration CVE-2026-44739 Fix available 8.7 HighMay 27, 2026
• pimcore Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering CVE-2026-5362 4.8 MediumApril 27, 2026
• pimcore Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling CVE-2026-5394 Fix available 7.0 HighApril 27, 2026
• pimcore Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause CVE-2026-27461 Fix available 6.9 MediumFebruary 24, 2026
• pimcore, pimcore web2print tools +1 more Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization CVE-2026-23496 Fix available 5.4 MediumJanuary 15, 2026
• pimcore Pimcore is Missing Function Level Authorization on "Static Routes" Listing CVE-2026-23494 Fix available 4.3 MediumJanuary 15, 2026
• pimcore admin classic bundle, pimcore +1 more Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing CVE-2026-23495 Fix available 4.3 MediumJanuary 15, 2026
• pimcore Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVE-2026-23493 Fix available 8.6 HighJanuary 15, 2026
• pimcore Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CVE-2026-23492 Fix available 8.8 HighJanuary 14, 2026
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore's Admin Classic Bundle allows HTML Injection CVE-2025-30166 Fix available 1.8 LowApril 8, 2025
• pimcore Pimcore Vulnerable to SQL Injection in getRelationFilterCondition CVE-2025-27617 Fix available 6.3 MediumMarch 11, 2025
• pimcore admin-ui-classic-bundle, admin classic bundle +1 more Pimcore Admin Classic Bundle allows user enumeration CVE-2025-24980 Fix available 6.9 MediumFebruary 7, 2025
• pimcore customer-data-framework, pimcore +1 more Pimcore customer-data-framework list sql injection CVE-2024-11956 Public exploitFix available 5.1 MediumJanuary 28, 2025
• pimcore Pimcore Search Document cross site scripting CVE-2024-11954 Public exploitFix available 5.1 MediumJanuary 28, 2025
• pimcore Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing CVE-2024-49370 8.7 HighOctober 23, 2024
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore vulnerable to disclosure of system and database information behind /admin firewall CVE-2024-41109 Fix available 6.3 MediumJuly 30, 2024
• pimcore Pimcore Vulnerable to Flooding Server with Thumbnail files CVE-2024-32871 Fix available 7.5 HighJune 4, 2024
• pimcore Pimcore Preview Documents are not restricted to logged in users anymore CVE-2024-29197 Fix available 6.5 MediumMarch 26, 2024
• pimcore admin-ui-classic-bundle, admin classic bundle +1 more Pimcore Host Header Injection in user invitation link CVE-2024-25625 Fix available 8.1 HighFebruary 19, 2024
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin Classic Bundle permissions are not getting checked when working with tags CVE-2024-24822 Fix available 6.5 MediumFebruary 7, 2024
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip CVE-2024-23646 Fix available 8.8 HighJanuary 24, 2024
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin Classic Bundle host header injection in the password reset CVE-2024-23648 Fix available 8.8 HighJanuary 24, 2024
• pimcore customer-data-framework, customer management framework +1 more Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts CVE-2024-21667 Fix available 6.5 MediumJanuary 10, 2024
• pimcore customer management framework, customer-data-framework +1 more Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list CVE-2024-21666 Fix available 6.5 MediumJanuary 10, 2024
• pimcore ecommerce-framework-bundle, e-commerce framework +1 more Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list CVE-2024-21665 Fix available 4.3 MediumJanuary 10, 2024
• pimcore customer-data-framework, pimcore +1 more Pimcore missing token/header to prevent CSRF CVE-2023-49076 4.3 MediumNovember 30, 2023
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls CVE-2023-49075 Fix available 8.5 HighNovember 27, 2023
• pimcore SQL Injection in Admin Grid Filter API in Pimcore CVE-2023-47637 Fix available 8.8 HighNovember 15, 2023
• pimcore admin-ui-classic-bundle, admin classic bundle +1 more Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle CVE-2023-47636 Fix available 5.3 MediumNovember 15, 2023
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews CVE-2023-46722 Fix available 6.1 MediumOctober 31, 2023
• pimcore, pimcore pimcore/pimcore +1 more Cross-site Scripting (XSS) - Stored in pimcore/pimcore CVE-2023-5873 Fix available 4.0 MediumOctober 31, 2023
• pimcore pimcore/admin-ui-classic-bundle, admin classic bundle +1 more Unverified Password Change in pimcore/admin-ui-classic-bundle CVE-2023-5844 Fix available 4.3 MediumOctober 30, 2023
• pimcore core, pimcore, pimcore pimcore/demo +2 more Excessive Data Query Operations in a Large Data Table in pimcore/demo CVE-2023-5192 Fix available 6.1 MediumSeptember 26, 2023
• pimcore admin-ui-classic-bundle, admin classic bundle +1 more Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations CVE-2023-42817 Fix available 5.4 MediumSeptember 25, 2023
• pimcore, pimcore pimcore/pimcore +1 more Cross-site Scripting (XSS) - Reflected in pimcore/pimcore CVE-2023-4453 Fix available 6.4 MediumAugust 21, 2023
• pimcore Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction CVE-2023-38708 Fix available 6.3 MediumAugust 3, 2023
• Show olderLoading…