Pimcore
142 CVEs across 20 Pimcore products. Browse Pimcore vulnerabilities, severities, and proof-of-concept exploits.
Pimcore products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44741 | High | 8.8 | 2026-08-12 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translatio… |
CVE-2026-72562 | High | 8.8 | 2026-08-11 | An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataO… |
CVE-2026-45704 | | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the r… | |
CVE-2026-45260 | High | 8.1 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation th… |
CVE-2026-44739 | High | 8.7 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBun… |
CVE-2026-45703 | Medium | 6.4 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/… |
CVE-2026-45162 | High | 8.0 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data… |
CVE-2026-55212 | High | 7.1 | 2026-07-09 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcor… |
CVE-2026-55208 | High | 7.7 | 2026-07-09 | Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password ha… |
CVE-2026-55207 | High | 8.8 | 2026-07-09 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username c… |
CVE-2026-5362 | Medium | 5.4 | 2026-04-27 | An authenticated attacker with permission to edit document content can store crafted HTML/JavaScript in a Document embed editable and cause script execution wh… |
CVE-2026-5394 | | 2026-04-27 | An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger un… | |
CVE-2026-27461 | Medium | 4.9 | 2026-02-24 | Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the depend… |
CVE-2026-23496 | Medium | 5.4 | 2026-01-15 | Pimcore Web2Print Tools Bundle adds tools for web-to-print use cases to Pimcore. Prior to 5.2.2 and 6.1.1, the application fails to enforce proper server-side… |
CVE-2026-23495 | Medium | 4.3 | 2026-01-15 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore… |
CVE-2026-23494 | Medium | 4.3 | 2026-01-15 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization… |
CVE-2026-23493 | High | 8.6 | 2026-01-15 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variable… |
CVE-2026-23492 | High | 8.8 | 2026-01-14 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API al… |
CVE-2025-30166 | Medium | 4.8 | 2025-04-08 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject… |
CVE-2025-27617 | High | 8.8 | 2025-03-11 | Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL i… |
CVE-2025-24980 | Medium | 5.3 | 2025-02-07 | pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumerat… |
CVE-2024-11956 | Medium | 4.7 | 2025-01-28 | A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functi… |
CVE-2024-11954 | Low | 2.4 | 2025-01-28 | A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Docum… |
CVE-2023-2332 | Medium | 4.8 | 2024-11-15 | A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is prese… |
CVE-2024-49370 | Medium | 4.9 | 2024-10-23 | Pimcore is an open source data and experience management platform. When a PortalUserObject is connected to a PimcoreUser and "Use Pimcore Backend Password" is… |
CVE-2024-41109 | Medium | 6.3 | 2024-07-30 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes inf… |
CVE-2024-32871 | High | 7.5 | 2024-06-04 | Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing… |
CVE-2024-29197 | Medium | 6.5 | 2024-03-26 | Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In… |
CVE-2024-25625 | High | 8.1 | 2024-02-19 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` p… |
CVE-2024-24822 | Medium | 6.5 | 2024-02-07 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having t… |
CVE-2024-23646 | High | 8.8 | 2024-01-24 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site… |
CVE-2024-23648 | High | 8.8 | 2024-01-24 | Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password chan… |
CVE-2024-21667 | Medium | 6.5 | 2024-01-11 | pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and unauthorized user can… |
CVE-2024-21666 | Medium | 6.5 | 2024-01-11 | The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marketing automation. An… |
CVE-2024-21665 | Medium | 4.3 | 2024-01-11 | ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able… |
CVE-2023-49076 | Medium | 4.3 | 2023-11-30 | Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an… |
CVE-2023-49075 | High | 8.4 | 2023-11-28 | The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authe… |
CVE-2023-47637 | High | 8.8 | 2023-11-15 | Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on f… |
CVE-2023-47636 | Medium | 5.3 | 2023-11-15 | The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webro… |
CVE-2023-46722 | Medium | 6.1 | 2023-10-31 | The Pimcore Admin Classic Bundle provides a backend UI for Pimcore. Prior to version 1.2.0, a cross-site scripting vulnerability has the potential to steal a u… |
CVE-2023-5873 | Medium | 5.4 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0. |
CVE-2023-5844 | High | 7.2 | 2023-10-30 | Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0. |
CVE-2023-5192 | Medium | 6.5 | 2023-09-27 | Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0. |
CVE-2023-42817 | Medium | 5.4 | 2023-09-25 | Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even… |
CVE-2023-4453 | Medium | 5.4 | 2023-08-21 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8. |
CVE-2023-38708 | Medium | 6.3 | 2023-08-04 | Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `… |
CVE-2023-4145 | Medium | 5.4 | 2023-08-03 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/customer-data-framework prior to 3.4.2. |
CVE-2023-3822 | Medium | 6.1 | 2023-07-21 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4. |
CVE-2023-3821 | Medium | 5.4 | 2023-07-21 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4. |
CVE-2023-3820 | High | 7.2 | 2023-07-21 | SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4. |
CVE-2023-3819 | Medium | 6.5 | 2023-07-21 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4. |
CVE-2023-3673 | High | 7.2 | 2023-07-14 | SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24. |
CVE-2023-37280 | Medium | 5.0 | 2023-07-11 | Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vul… |
CVE-2023-3574 | Medium | 6.5 | 2023-07-10 | Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1. |
CVE-2023-2984 | High | 8.8 | 2023-05-30 | Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22. |
CVE-2023-2983 | High | 8.8 | 2023-05-30 | Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23. |
CVE-2023-2881 | Medium | 4.9 | 2023-05-25 | Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10. |
CVE-2023-2756 | High | 7.2 | 2023-05-17 | SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10. |
CVE-2023-2730 | Medium | 5.4 | 2023-05-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. |
CVE-2023-32075 | Medium | 4.3 | 2023-05-11 | The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to… |
CVE-2023-2630 | Medium | 4.8 | 2023-05-10 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2629 | High | 7.8 | 2023-05-10 | Improper Neutralization of Formula Elements in a CSV File in GitHub repository pimcore/customer-data-framework prior to 3.3.9. |
CVE-2023-2615 | Medium | 5.4 | 2023-05-10 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2614 | Medium | 5.4 | 2023-05-10 | Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2616 | Medium | 5.4 | 2023-05-10 | Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-30855 | Medium | 6.5 | 2023-05-08 | Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this pa… |
CVE-2023-2361 | Medium | 5.4 | 2023-04-28 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-30852 | Medium | 4.4 | 2023-04-27 | Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by… |
CVE-2023-30850 | High | 8.8 | 2023-04-27 | Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API… |
CVE-2023-30849 | High | 8.8 | 2023-04-27 | Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API… |
CVE-2023-30848 | High | 8.8 | 2023-04-27 | Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users… |
CVE-2023-2343 | Medium | 5.4 | 2023-04-27 | Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2342 | Medium | 5.4 | 2023-04-27 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2341 | Medium | 6.1 | 2023-04-27 | Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2340 | Medium | 5.4 | 2023-04-27 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2339 | Medium | 5.4 | 2023-04-27 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2338 | High | 8.8 | 2023-04-27 | SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2336 | Medium | 6.5 | 2023-04-27 | Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2328 | Medium | 5.4 | 2023-04-27 | Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2327 | Medium | 5.4 | 2023-04-27 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2323 | Medium | 5.4 | 2023-04-27 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-2322 | Medium | 5.4 | 2023-04-27 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. |
CVE-2023-28850 | Medium | 6.1 | 2023-04-03 | Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potent… |
CVE-2023-1704 | Medium | 5.4 | 2023-03-29 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20. |
CVE-2023-1703 | Medium | 5.4 | 2023-03-29 | Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20. |
CVE-2023-1702 | Medium | 5.4 | 2023-03-29 | Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20. |
CVE-2023-1701 | Medium | 5.4 | 2023-03-29 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20. |
CVE-2023-28438 | Medium | 6.2 | 2023-03-22 | Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary… |
CVE-2023-1578 | High | 8.8 | 2023-03-22 | SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19. |
CVE-2023-1517 | Medium | 4.8 | 2023-03-20 | Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19. |
CVE-2023-28429 | Medium | 6.1 | 2023-03-20 | Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. Th… |
CVE-2023-1515 | Medium | 5.4 | 2023-03-20 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. |
CVE-2023-28108 | High | 7.9 | 2023-03-16 | Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theor… |
CVE-2023-28106 | Medium | 6.1 | 2023-03-16 | Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious scrip… |
CVE-2023-1429 | Medium | 5.4 | 2023-03-16 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. |
CVE-2023-1312 | Medium | 4.8 | 2023-03-10 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. |
CVE-2023-1286 | Medium | 4.8 | 2023-03-09 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. |
CVE-2023-1117 | Medium | 5.4 | 2023-03-01 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. |
CVE-2023-1116 | Medium | 5.4 | 2023-03-01 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. |
CVE-2023-1115 | Medium | 5.4 | 2023-03-01 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. |