Pimcore Core vulnerabilities

• pimcore Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview CVE-2026-109392 5.1 MediumOctober 12, 2026
• pimcore Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization CVE-2026-55416 Fix available 8.8 HighSeptember 10, 2026
• pimcore Pimcore: Remote Code Execution via DataObject Class-Definition Field Name CVE-2026-55634 Fix available 9.9 CriticalAugust 28, 2026
• pimcore Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column CVE-2026-55220 Fix available 9.3 CriticalAugust 28, 2026
• pimcore Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name CVE-2026-55072 Fix available 8.5 HighAugust 13, 2026
• pimcore admin-ui-classic-bundle Pimcore pimcore admin-ui-classic-bundle - SQL Injection CVE-2026-72562 8.8 HighAugust 11, 2026
• pimcore Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass CVE-2026-55207 Fix available 8.8 HighJuly 9, 2026
• pimcore Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes CVE-2026-55208 Fix available 7.7 HighJuly 9, 2026
• pimcore Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation CVE-2026-55212 Fix available 7.1 HighJuly 9, 2026
• pimcore Pimcore: CustomReports Share Bypass CVE-2026-45704 Fix available 7.1 HighMay 27, 2026
• pimcore Pimcore: WordExport Authorization Bypass for Unauthorized Document Export CVE-2026-45703 Fix available 6.4 MediumMay 27, 2026
• pimcore Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling CVE-2026-45260 Fix available 8.1 HighMay 27, 2026
• pimcore Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction CVE-2026-45162 Fix available 8.0 HighMay 27, 2026
• pimcore Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter CVE-2026-44741 Fix available 8.8 HighMay 27, 2026
• pimcore Pimcore: SQL Injection in Custom Reports Column Configuration CVE-2026-44739 Fix available 8.7 HighMay 27, 2026
• pimcore Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering CVE-2026-5362 4.8 MediumApril 27, 2026
• pimcore Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling CVE-2026-5394 Fix available 7.0 HighApril 27, 2026
• pimcore Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause CVE-2026-27461 Fix available 6.9 MediumFebruary 24, 2026
• pimcore, pimcore web2print tools +1 more Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization CVE-2026-23496 Fix available 5.4 MediumJanuary 15, 2026
• pimcore Pimcore is Missing Function Level Authorization on "Static Routes" Listing CVE-2026-23494 Fix available 4.3 MediumJanuary 15, 2026
• pimcore admin classic bundle, pimcore +1 more Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing CVE-2026-23495 Fix available 4.3 MediumJanuary 15, 2026
• pimcore Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVE-2026-23493 Fix available 8.6 HighJanuary 15, 2026
• pimcore Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CVE-2026-23492 Fix available 8.8 HighJanuary 14, 2026
• pimcore Pimcore Vulnerable to SQL Injection in getRelationFilterCondition CVE-2025-27617 Fix available 6.3 MediumMarch 11, 2025
• pimcore customer-data-framework, pimcore +1 more Pimcore customer-data-framework list sql injection CVE-2024-11956 Public exploitFix available 5.1 MediumJanuary 28, 2025
• pimcore Pimcore Search Document cross site scripting CVE-2024-11954 Public exploitFix available 5.1 MediumJanuary 28, 2025
• pimcore Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing CVE-2024-49370 8.7 HighOctober 23, 2024
• pimcore Pimcore Vulnerable to Flooding Server with Thumbnail files CVE-2024-32871 Fix available 7.5 HighJune 4, 2024
• pimcore Pimcore Preview Documents are not restricted to logged in users anymore CVE-2024-29197 Fix available 6.5 MediumMarch 26, 2024
• pimcore customer-data-framework, pimcore +1 more Pimcore missing token/header to prevent CSRF CVE-2023-49076 4.3 MediumNovember 30, 2023
• pimcore SQL Injection in Admin Grid Filter API in Pimcore CVE-2023-47637 Fix available 8.8 HighNovember 15, 2023
• pimcore, pimcore pimcore/pimcore +1 more Cross-site Scripting (XSS) - Stored in pimcore/pimcore CVE-2023-5873 Fix available 4.0 MediumOctober 31, 2023
• pimcore pimcore/admin-ui-classic-bundle, admin classic bundle +1 more Unverified Password Change in pimcore/admin-ui-classic-bundle CVE-2023-5844 Fix available 4.3 MediumOctober 30, 2023
• pimcore core, pimcore, pimcore pimcore/demo +2 more Excessive Data Query Operations in a Large Data Table in pimcore/demo CVE-2023-5192 Fix available 6.1 MediumSeptember 26, 2023
• pimcore, pimcore pimcore/pimcore +1 more Cross-site Scripting (XSS) - Reflected in pimcore/pimcore CVE-2023-4453 Fix available 6.4 MediumAugust 21, 2023
• pimcore Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction CVE-2023-38708 Fix available 6.3 MediumAugust 3, 2023
• pimcore customer-data-framework, pimcore/customer-data-framework, customer management framework +2 more Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework CVE-2023-4145 Fix available 6.5 MediumAugust 3, 2023
• pimcore, pimcore pimcore/pimcore +1 more Cross-site Scripting (XSS) - Reflected in pimcore/pimcore CVE-2023-3822 Fix available 6.0 MediumJuly 21, 2023
• pimcore, pimcore pimcore/pimcore +1 more Cross-site Scripting (XSS) - Stored in pimcore/pimcore CVE-2023-3821 Fix available 6.1 MediumJuly 21, 2023
• pimcore, pimcore pimcore/pimcore +1 more SQL Injection in pimcore/pimcore CVE-2023-3820 Fix available 7.2 HighJuly 21, 2023
• pimcore, pimcore pimcore/pimcore +1 more Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore CVE-2023-3819 Fix available 7.6 HighJuly 21, 2023
• pimcore, pimcore pimcore/pimcore +1 more SQL Injection in pimcore/pimcore CVE-2023-3673 Fix available 7.2 HighJuly 14, 2023
• pimcore customer-data-framework, pimcore/customer-data-framework, customer management framework +2 more Improper Authorization in pimcore/customer-data-framework CVE-2023-3574 Fix available 6.3 MediumJuly 10, 2023
• pimcore, pimcore pimcore/pimcore +1 more Path Traversal: '\..\filename' in pimcore/pimcore CVE-2023-2984 Fix available 6.3 MediumMay 30, 2023
• pimcore, pimcore pimcore/pimcore +1 more Privilege Defined With Unsafe Actions in pimcore/pimcore CVE-2023-2983 Fix available 6.5 MediumMay 30, 2023
• pimcore pimcore/customer-data-framework, customer management framework +1 more Storing Passwords in a Recoverable Format in pimcore/customer-data-framework CVE-2023-2881 Fix available 6.7 MediumMay 25, 2023
• pimcore pimcore/customer-data-framework, customer management framework +1 more SQL Injection in pimcore/customer-data-framework CVE-2023-2756 Fix available 6.5 MediumMay 17, 2023
• pimcore, pimcore pimcore/pimcore +1 more Cross-site Scripting (XSS) - Stored in pimcore/pimcore CVE-2023-2730 Fix available 6.3 MediumMay 16, 2023
• pimcore, pimcore pimcore/pimcore +1 more Cross-site Scripting (XSS) - Stored in pimcore/pimcore CVE-2023-2630 Fix available 5.7 MediumMay 10, 2023
• pimcore pimcore/customer-data-framework, customer management framework +1 more Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework CVE-2023-2629 Fix available 5.0 MediumMay 10, 2023
• Show olderLoading…