pimcore

Records172All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high62CVSS 7.0–8.9

Exploited now

pimcore records in CISA KEV

No pimcore vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pimcore 127 records HIGH Admin Classic Bundle 14 records HIGH Customer Management Framework 9 records HIGH Core 1 record MEDIUM Data-hub 1 record LOW E-commerce Framework 1 record LOW Perspective Editor 1 record LOW Web2print Tools 1 record MEDIUM

Records

172 records

TI-2026-18925 CVE-2026-23492 · GHSA-qvr7-7g55-69xj

Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848

HIGH 79

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00466 Published 2026-01-14 Fixed in 12.3.1, 11.5.14 CWE-89

TI-2024-15667 CVE-2024-23648 · GHSA-mrqg-mwh7-q94j

Pimcore Admin Classic Bundle host header injection in the password reset

HIGH 77

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00827 Published 2024-01-24 Fixed in 1.2.3 CWE-74

TI-2026-40161 CVE-2026-55634 · GHSA-9x44-4gxf-8c25

Pimcore: Remote Code Execution via DataObject Class-Definition Field Name

HIGH 76

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0065 Published 2026-08-28 Fixed in 11.5.19, 12.3.10 +1 CWE-89

TI-2026-18926 CVE-2026-23493 · GHSA-q433-j342-rp9h

Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

HIGH 76

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00427 Published 2026-01-15 Fixed in 12.3.1, 11.5.14 CWE-532

TI-2024-16853 CVE-2024-25625 · GHSA-3qpq-6w89-f7mx

Pimcore Host Header Injection in user invitation link

HIGH 75

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00682 Published 2024-02-19 Fixed in 1.3.4 CWE-74

TI-2023-01489 CVE-2023-1578 · GHSA-42c3-wvww-gcqj

SQL Injection in pimcore/pimcore

HIGH 75

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.62755 Published 2023-03-22 Fixed in 10.5.19 CWE-89

TI-2019-08091 CVE-2019-10867 · GHSA-7hqr-j26m-gmwp

An issue was discovered in Pimcore before 5.7.1.

HIGH 75

An issue was discovered in Pimcore before 5.7.1.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.68874 Published 2019-04-04 Fixed in 5.7.1 CWE-502

TI-2026-39887 CVE-2026-55207 · GHSA-h854-c3m3-mh5v

Weak password recovery in pimcore

HIGH 73

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00666 Published 2026-07-09 Fixed in 2026.1.6, 2025.4.6 CWE-640

TI-2026-32628 CVE-2026-44741 · GHSA-h4ph-crvj-9h92

SQL injection in pimcore

HIGH 73

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.005 Published 2026-08-12 Fixed in 1.7.18, 2.3.6 CWE-89

TI-2026-32626 CVE-2026-44739 · GHSA-3234-gxc3-pq6f

Pimcore: SQL Injection in Custom Reports Column Configuration

HIGH 73

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00392 Published 2026-07-17 Fixed in 11.5.17, 12.3.6 +1 CWE-89

TI-2024-15665 CVE-2024-23646 · GHSA-cwx6-4wmf-c6xv

Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

HIGH 73

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00997 Published 2024-01-24 Fixed in 1.3.2 CWE-89

TI-2023-25778 CVE-2023-47637 · GHSA-72hh-xf79-429p

SQL Injection in Admin Grid Filter API in Pimcore

HIGH 73

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01218 Published 2023-11-15 Fixed in 11.1.1 CWE-89

TI-2023-10682 CVE-2023-25240 · GHSA-r2vq-p658-p274

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.

HIGH 73

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00982 Published 2023-02-13 Fixed in 10.5.16 CWE-1265

TI-2023-02795 CVE-2023-2983 · GHSA-m4mv-rmr7-h5f5

Privilege Defined With Unsafe Actions in pimcore/pimcore

HIGH 73

Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00919 Published 2023-05-30 Fixed in 10.5.23 CWE-267

TI-2023-02194 CVE-2023-2338 · GHSA-4x35-vr82-xvj6

SQL Injection in pimcore/pimcore

HIGH 73

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0091 Published 2023-04-27 Fixed in 10.5.21 CWE-89

TI-2024-32958 CVE-2024-49370

Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing

HIGH 71

Pimcore is an open source data and experience management platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00521 Published 2024-10-23 Fixed in 3.1.16, 4.1.7 CWE-256

TI-2023-02796 CVE-2023-2984 · GHSA-46g3-f9r8-xj4v

Path Traversal: '\..\filename' in pimcore/pimcore

HIGH 71

Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00854 Published 2023-05-30 Fixed in 10.5.22 CWE-29

TI-2026-39777 CVE-2026-55072 · GHSA-2mhj-fhvg-v428

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

HIGH 70

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00409 Published 2026-09-14 Fixed in 2026.1.5, 12.3.9 CWE-20

TI-2026-32989 CVE-2026-45162 · GHSA-36fc-7wjg-mfvj

Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

HIGH 70

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.00987 Published 2026-07-17 Fixed in 11.5.17, 12.3.7 +1 CWE-502

TI-2025-18658 CVE-2025-24980 · GHSA-vr5f-php7-rg24

Pimcore Admin Classic Bundle allows user enumeration

HIGH 70

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00519 Published 2025-02-07 Fixed in 1.7.4 CWE-204

TI-2022-13136 CVE-2022-31092 · GHSA-gvmf-wcx6-p974

SQL injection in pimcore

HIGH 70

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01416 Published 2022-06-27 Fixed in 10.4.4 CWE-89

TI-2026-33067 CVE-2026-45260 · GHSA-wc7j-g8wx-m2qx

Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

HIGH 68

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00636 Published 2026-07-17 Fixed in 11.5.17, 12.3.7 +1 CWE-862

TI-2022-01310 CVE-2022-1429 · GHSA-2v7p-f4qm-r5pc

SQL injection in GridHelperService.php in pimcore/pimcore

HIGH 68

SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.63859 Published 2022-04-22 Fixed in 10.3.6 CWE-89

TI-2026-39888 CVE-2026-55208 · GHSA-79cw-hfcc-7mw9

SQL injection in pimcore

HIGH 67

Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00413 Published 2026-07-09 Fixed in 2026.1.6, 2025.4.6 CWE-89

TI-2023-03569 CVE-2023-3820 · GHSA-c9hw-557q-f8hq

SQL Injection in pimcore/pimcore

HIGH 67

SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01155 Published 2023-07-21 Fixed in 10.6.4 CWE-89

Open these records in search →

Critical	8
High	62
Medium	101
Low	1
No CVSS	0