Pimcore
Page 2 of 2 — Pimcore CVEs from a corpus of 166, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1067 | Medium | 5.4 | 2023-02-27 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. |
CVE-2023-0827 | Medium | 5.4 | 2023-02-14 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17. |
CVE-2023-25240 | High | 8.8 | 2023-02-13 | An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. |
CVE-2023-23937 | High | 8.2 | 2023-02-03 | Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user pro… |
CVE-2023-0323 | Medium | 5.4 | 2023-01-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14. |
CVE-2022-39365 | Critical | 9.8 | 2022-10-27 | Pimcore is an open source data and experience management platform. Prior to version 10.5.9, the user controlled twig templates rendering in `Pimcore/Mail` & `C… |
CVE-2022-3255 | Medium | 4.8 | 2022-09-21 | If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the att… |
CVE-2022-3211 | Medium | 5.4 | 2022-09-15 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6. |
CVE-2022-2796 | Medium | 4.8 | 2022-08-23 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4. |
CVE-2022-31092 | High | 7.5 | 2022-06-27 | Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes a… |
CVE-2022-1429 | High | 7.5 | 2022-04-22 | SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data |
CVE-2022-1351 | Medium | 5.4 | 2022-04-14 | Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4. |
CVE-2022-1339 | High | 7.5 | 2022-04-13 | SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data |
CVE-2022-1219 | High | 7.5 | 2022-04-08 | SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data |
CVE-2022-0955 | Medium | 4.8 | 2022-03-24 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4. |
CVE-2022-0705 | Medium | 5.4 | 2022-03-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-0704 | Medium | 5.4 | 2022-03-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-0911 | Medium | 5.4 | 2022-03-16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-0894 | Medium | 5.4 | 2022-03-15 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-0893 | Medium | 5.4 | 2022-03-15 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. |
CVE-2022-0832 | Medium | 5.4 | 2022-03-04 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. |
CVE-2022-0831 | Medium | 5.4 | 2022-03-04 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. |
CVE-2022-0665 | Medium | 6.5 | 2022-02-22 | Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2. |
CVE-2022-0565 | High | 7.6 | 2022-02-14 | Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1. |
CVE-2022-0510 | Medium | 5.4 | 2022-02-08 | Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1. |
CVE-2022-0509 | Medium | 5.4 | 2022-02-08 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1. |
CVE-2022-0348 | Medium | 5.4 | 2022-01-27 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2. |
CVE-2022-0251 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10. |
CVE-2022-0285 | Medium | 5.4 | 2022-01-20 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9. |
CVE-2022-0263 | High | 7.8 | 2022-01-18 | Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7. |
CVE-2022-0262 | Medium | 6.1 | 2022-01-18 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7. |
CVE-2021-4146 | Medium | 4.3 | 2022-01-18 | Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6. |
CVE-2022-0260 | Medium | 5.4 | 2022-01-18 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7. |
CVE-2022-0258 | High | 8.8 | 2022-01-17 | pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command |
CVE-2022-0257 | Medium | 5.4 | 2022-01-17 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2022-0256 | Medium | 5.4 | 2022-01-17 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-4139 | Critical | 9.0 | 2021-12-21 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-4084 | Medium | 6.1 | 2021-12-10 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-4082 | Medium | 4.3 | 2021-12-10 | pimcore is vulnerable to Cross-Site Request Forgery (CSRF) |
CVE-2021-4081 | Medium | 6.1 | 2021-12-10 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
CVE-2021-39189 | Medium | 5.3 | 2021-09-15 | Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password fun… |
CVE-2021-39170 | High | 8.0 | 2021-09-01 | Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadat… |
CVE-2021-39166 | High | 8.0 | 2021-09-01 | Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version p… |
CVE-2021-37702 | High | 8.0 | 2021-08-18 | Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patc… |
CVE-2021-31869 | Medium | 6.5 | 2021-08-04 | Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was fixed in ve… |
CVE-2021-31867 | Medium | 6.5 | 2021-08-04 | Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentC… |
CVE-2021-23405 | High | 8.3 | 2021-07-09 | This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionG… |
CVE-2021-23340 | High | 7.1 | 2021-02-18 | This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportControl… |
CVE-2020-26246 | High | 7.7 | 2020-12-03 | Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the ap… |
CVE-2020-7759 | Medium | 6.5 | 2020-10-30 | The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController… |
CVE-2019-10763 | Medium | 6.5 | 2019-11-18 | pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead… |
CVE-2019-18986 | High | 7.5 | 2019-11-15 | Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for in… |
CVE-2019-18985 | Critical | 9.8 | 2019-11-15 | Pimcore before 6.2.2 lacks brute force protection for the 2FA token. |
CVE-2019-18982 | Medium | 6.1 | 2019-11-15 | bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of… |
CVE-2019-18981 | Critical | 9.8 | 2019-11-15 | Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification. |
CVE-2019-18656 | Medium | 6.1 | 2019-10-31 | Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML element… |
CVE-2019-16318 | High | 8.8 | 2019-09-14 | In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failur… |
CVE-2019-16317 | High | 8.8 | 2019-09-14 | In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uplo… |
CVE-2019-10867 | High | 8.8 | 2019-04-04 | An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it po… |
CVE-2018-14059 | Medium | 5.4 | 2018-08-24 | Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, P… |
CVE-2018-14058 | Medium | 6.5 | 2018-08-17 | Pimcore before 5.3.0 allows SQL Injection via the REST web service API. |
CVE-2018-14057 | High | 8.8 | 2018-08-17 | Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSR… |
CVE-2015-4426 | | 2015-08-18 | SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid… | |
CVE-2015-4425 | | 2015-08-18 | Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary f… | |
CVE-2014-2922 | | 2014-04-21 | The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtaine… | |
CVE-2014-2921 | | 2014-04-21 | The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtaine… |