Read the docs

pimcore

Records172All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high62CVSS 7.0–8.9

Exploited now

pimcore records in CISA KEV

No pimcore vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Pimcore 127 records HIGH Admin Classic Bundle 14 records HIGH Customer Management Framework 9 records HIGH Core 1 record MEDIUM Data-hub 1 record LOW E-commerce Framework 1 record LOW Perspective Editor 1 record LOW Web2print Tools 1 record MEDIUM

Records

127 records in Pimcore · all components

TI-2023-01489 CVE-2023-1578 · GHSA-42c3-wvww-gcqj

SQL Injection in pimcore/pimcore

Priority HIGH 75

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.62755 Published 2023-03-22 Fixed in 10.5.19 CWE-89
TI-2023-02194 CVE-2023-2338 · GHSA-4x35-vr82-xvj6

SQL Injection in pimcore/pimcore

Priority HIGH 73

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0091 Published 2023-04-27 Fixed in 10.5.21 CWE-89
TI-2023-02796 CVE-2023-2984 · GHSA-46g3-f9r8-xj4v

Path Traversal: '\..\filename' in pimcore/pimcore

Priority HIGH 71

Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00854 Published 2023-05-30 Fixed in 10.5.22 CWE-29
TI-2022-13136 CVE-2022-31092 · GHSA-gvmf-wcx6-p974

SQL injection in pimcore

Priority HIGH 70

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01416 Published 2022-06-27 Fixed in 10.4.4 CWE-89
TI-2023-03569 CVE-2023-3820 · GHSA-c9hw-557q-f8hq

SQL Injection in pimcore/pimcore

Priority HIGH 67

SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01155 Published 2023-07-21 Fixed in 10.6.4 CWE-89
TI-2023-03430 CVE-2023-3673 · GHSA-rxp5-qwrf-pfv3

SQL Injection in pimcore/pimcore

Priority HIGH 67

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00891 Published 2023-07-14 Fixed in 10.5.24 CWE-89
TI-2022-00484 CVE-2022-0565 · GHSA-h9vc-2p9g-63gp

Cross-site Scripting in pimcore/pimcore

Priority HIGH 66

Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00976 Published 2022-02-12 Fixed in 10.3.1 CWE-79
TI-2023-00307 CVE-2023-0323 · GHSA-6vf6-g3pr-j83h

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Priority MEDIUM 64

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00472 Published 2023-01-16 Fixed in 10.5.14 CWE-79
TI-2023-26741 CVE-2023-49076

Pimcore missing token/header to prevent CSRF

Priority MEDIUM 62

Customer-data-framework allows management of customer data within Pimcore.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00258 Published 2023-11-30 Fixed in 4.0.5 CWE-352
TI-2023-02192 CVE-2023-2336 · GHSA-hg77-vx9v-f49x

Path Traversal in pimcore/pimcore

Priority MEDIUM 62

Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00666 Published 2023-04-27 Fixed in 10.5.21 CWE-22
TI-2022-00739 CVE-2022-0832 · GHSA-6qcc-whgp-pjj2

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Priority MEDIUM 61

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.6662 Published 2022-03-04 Fixed in 10.3.3 CWE-79
Load more
Open these records in search →