Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

172 records

Vendor: pimcore Clear all filters
TI-2026-71028 CVE-2026-109392 · GHSA-w844-4xmf-w7mw

Stored cross-site scripting in Pimcore via ExternalImage fields

Priority MEDIUM 56

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00171 Published 2026-10-12 No fix listed CWE-79
TI-2026-39985 CVE-2026-55416 · GHSA-23rh-xw42-fq82

SQL injection in pimcore

Priority MEDIUM 41

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0065 Published 2026-09-14 Fixed in 11.5.19, 12.3.10 +1 CWE-89
TI-2026-32628 CVE-2026-44741 · GHSA-h4ph-crvj-9h92

SQL injection in pimcore

Priority HIGH 73

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.005 Published 2026-08-12 Fixed in 1.7.18, 2.3.6 CWE-89
TI-2026-50821 CVE-2026-72562 · GHSA-676q-ggmp-8439

Pimcore pimcore admin-ui-classic-bundle - SQL Injection

Priority MEDIUM 40

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0043 Published 2026-08-11 No fix listed CWE-89
TI-2026-33445 CVE-2026-45704 · GHSA-jwcc-gv4m-93x6

Pimcore: CustomReports Share Bypass

Priority MEDIUM 64

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00427 Published 2026-07-17 Fixed in 11.5.17, 12.3.6 +1 CWE-862
TI-2026-39887 CVE-2026-55207 · GHSA-h854-c3m3-mh5v

Weak password recovery in pimcore

Priority HIGH 73

Pimcore is an Open Source Data & Experience Management Platform.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00666 Published 2026-07-09 Fixed in 2026.1.6, 2025.4.6 CWE-640
TI-2026-39888 CVE-2026-55208 · GHSA-79cw-hfcc-7mw9

SQL injection in pimcore

Priority HIGH 67

Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00413 Published 2026-07-09 Fixed in 2026.1.6, 2025.4.6 CWE-89
TI-2026-09844 CVE-2026-11407 · GHSA-7p36-fq2r-4h7r

Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

Priority MEDIUM 40

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkProp…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00623 Published 2026-06-17 Fixed in fffa7f6396329e88610db70a8652529bbc734892 CWE-1336
TI-2026-04691 CVE-2026-5362 · GHSA-7gxw-q9j5-mrj4

Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering

Priority LOW 21

An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution when the published page is rendered.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00194 Published 2026-04-27 No fix listed CWE-79
TI-2026-04721 CVE-2026-5394 · GHSA-r2f4-ff2p-xc64

Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling

Priority LOW 31

An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00434 Published 2026-04-27 Fixed in 12.3.7, 11.5.17 +1 CWE-89
Load more