Priority LOW 21
An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered.
CVSS 4.0MEDIUM 4.8· Network · Low privileges · User interaction · EPSS 0.00194 · Published 2026-04-27 · No fix listed CWE-79
Priority MEDIUM 64
Pimcore is an Open Source Data & Experience Management Platform.
CVSS 4.0MEDIUM 6.9· Network · High privileges · No interaction · EPSS 0.00509 · Published 2026-02-24 · Fixed in 12.3.3 CWE-89
Priority MEDIUM 62
Pimcore is an Open Source Data & Experience Management Platform.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00346 · Published 2026-01-15 · Fixed in 12.3.1, 11.5.14 CWE-284
Priority HIGH 76
Pimcore is an Open Source Data & Experience Management Platform.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00427 · Published 2026-01-15 · Fixed in 12.3.1, 11.5.14 CWE-532
Priority HIGH 79
Pimcore is an Open Source Data & Experience Management Platform.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00466 · Published 2026-01-14 · Fixed in 12.3.1, 11.5.14 CWE-89
Priority LOW 31
Pimcore is an open source data and experience management platform.
CVSS 4.0MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00498 · Published 2025-03-11 · Fixed in 11.5.4 CWE-89
Priority MEDIUM 56
A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00908 · Published 2025-01-28 · Fixed in 4.2.1 CWE-74
Priority MEDIUM 56
A vulnerability classified as problematic was found in Pimcore 11.4.2.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.01118 · Published 2025-01-28 · Fixed in 11.5.3 CWE-74
Priority MEDIUM 55
A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.0037 · Published 2024-11-15 · Fixed in 10.5.21 CWE-79
Priority HIGH 71
Pimcore is an open source data and experience management platform.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00521 · Published 2024-10-23 · Fixed in 3.1.16, 4.1.7 CWE-256
Priority MEDIUM 40
Pimcore is an Open Source Data & Experience Management Platform.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00763 · Published 2024-06-04 · Fixed in 11.2.4 CWE-770
Priority MEDIUM 62
Pimcore is an Open Source Data & Experience Management Platform.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00713 · Published 2024-03-26 · Fixed in 11.1.6.1, 11.2.2 CWE-200
Priority MEDIUM 62
Customer-data-framework allows management of customer data within Pimcore.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00258 · Published 2023-11-30 · Fixed in 4.0.5 CWE-352
Priority HIGH 73
Pimcore is an Open Source Data & Experience Management Platform.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01218 · Published 2023-11-15 · Fixed in 11.1.1 CWE-89
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00383 · Published 2023-10-31 · Fixed in 11.1.0 CWE-79
Priority MEDIUM 60
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00582 · Published 2023-08-21 · Fixed in 10.6.8 CWE-79
Priority LOW 39
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00641 · Published 2023-08-04 · Fixed in 10.6.7 CWE-22
Priority MEDIUM 60
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00547 · Published 2023-07-21 · Fixed in 10.6.4 CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0057 · Published 2023-07-21 · Fixed in 10.6.4 CWE-79
Priority HIGH 67
SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01155 · Published 2023-07-21 · Fixed in 10.6.4 CWE-89
Priority MEDIUM 62
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00655 · Published 2023-07-21 · Fixed in 10.6.4 CWE-200
Priority HIGH 67
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00891 · Published 2023-07-14 · Fixed in 10.5.24 CWE-89
Priority HIGH 71
Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00854 · Published 2023-05-30 · Fixed in 10.5.22 CWE-29
Priority HIGH 73
Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00919 · Published 2023-05-30 · Fixed in 10.5.23 CWE-267
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00479 · Published 2023-05-16 · Fixed in 10.3.3 CWE-79
Load more
THREATIST.IORead the docs