CVEs we hold for Pimcore

Records whose assigning authority named Pimcore as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-72562Pimcore pimcore admin-ui-classic-bundle - SQL Injectionpimcore admin-ui-classic-bundle

CVE-2026-55634Pimcore: Remote Code Execution via DataObject Class-Definition Field Namepimcore

CVE-2026-55416Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration…pimcore

CVE-2026-55220Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store columnpimcore

CVE-2026-55212Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalationpimcore

CVE-2026-55208Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data…pimcore

CVE-2026-55207Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account…pimcore

CVE-2026-55072Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table namepimcore

CVE-2026-5394Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handlingpimcore

CVE-2026-5362Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed renderingpimcore

CVE-2026-45704Pimcore: CustomReports Share Bypasspimcore

CVE-2026-45703Pimcore: WordExport Authorization Bypass for Unauthorized Document Exportpimcore

CVE-2026-45260Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handlingpimcore

CVE-2026-45162Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restrictionpimcore

CVE-2026-44741Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property…pimcore

CVE-2026-44739Pimcore: SQL Injection in Custom Reports Column Configurationpimcore

CVE-2026-27461Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clausepimcore

CVE-2026-23496Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorizationpimcore

CVE-2026-23495Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listingpimcore

CVE-2026-23494Pimcore is Missing Function Level Authorization on "Static Routes" Listingpimcore

CVE-2026-23493Pimcore ENV Variables and Cookie Informations are exposed in http_error_logpimcore

CVE-2026-23492Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848pimcore

CVE-2026-11407Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowedPimcore CMS/DXP

CVE-2025-30166Pimcore's Admin Classic Bundle allows HTML Injectionpimcore admin-ui-classic-bundle

CVE-2025-27617Pimcore Vulnerable to SQL Injection in getRelationFilterConditionpimcore

CVE-2025-24980Pimcore Admin Classic Bundle allows user enumerationpimcore admin-ui-classic-bundle

CVE-2024-49370Change-Password via Portal-Profile sets PimcoreBackendUser password without hashingpimcore

CVE-2024-41109Pimcore vulnerable to disclosure of system and database information behind /admin firewallpimcore admin-ui-classic-bundle

CVE-2024-32871Pimcore Vulnerable to Flooding Server with Thumbnail filespimcore

CVE-2024-29197Pimcore Preview Documents are not restricted to logged in users anymorepimcore

CVE-2024-25625Pimcore Host Header Injection in user invitation linkpimcore admin-ui-classic-bundle

CVE-2024-24822Pimcore Admin Classic Bundle permissions are not getting checked when working with tagspimcore admin-ui-classic-bundle

CVE-2024-23648Pimcore Admin Classic Bundle host header injection in the password resetpimcore admin-ui-classic-bundle

CVE-2024-23646Pimcore Admin Classic Bundle SQL Injection in Admin download files as zippimcore admin-ui-classic-bundle

CVE-2024-21667Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extractspimcore customer-data-framework

CVE-2024-21666Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates listpimcore customer-data-framework

CVE-2024-21665Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders listpimcore ecommerce-framework-bundle

CVE-2024-11956Pimcore customer-data-framework list sql injectionPimcore customer-data-framework

CVE-2024-11954Pimcore Search Document cross site scriptingn/a Pimcore

CVE-2023-5873Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-5844Unverified Password Change in pimcore/admin-ui-classic-bundlepimcore/admin-ui-classic-bundle

CVE-2023-5192Excessive Data Query Operations in a Large Data Table in pimcore/demopimcore/demo

CVE-2023-49076Pimcore missing token/header to prevent CSRFpimcore customer-data-framework

CVE-2023-49075Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewallspimcore admin-ui-classic-bundle

CVE-2023-47637SQL Injection in Admin Grid Filter API in Pimcorepimcore

CVE-2023-47636Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundlepimcore admin-ui-classic-bundle

CVE-2023-46722Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previewspimcore admin-ui-classic-bundle

CVE-2023-4453Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2023-42817Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translationspimcore admin-ui-classic-bundle

CVE-2023-4145Cross-site Scripting (XSS) - Stored in pimcore/customer-data-frameworkpimcore/customer-data-framework

CVE-2023-38708Pimcore Path Traversal Vulnerability in AssetController:importServerFilesActionpimcore

CVE-2023-3822Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2023-3821Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-3820SQL Injection in pimcore/pimcorepimcore/pimcore

CVE-2023-3819Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcorepimcore/pimcore

CVE-2023-37280Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup pagepimcore admin-ui-classic-bundle

CVE-2023-3673SQL Injection in pimcore/pimcorepimcore/pimcore

CVE-2023-3574Improper Authorization in pimcore/customer-data-frameworkpimcore/customer-data-framework

CVE-2023-32075Pimcore vulnerable to Business Logic Errors in Customer automation rulespimcore customer-data-framework

CVE-2023-30855Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.phppimcore

CVE-2023-30852Pimcore Arbitrary File Read in Admin JS CSS filespimcore

CVE-2023-30850Pimcore SQL Injection Vulnerability in Admin Translations APIpimcore

CVE-2023-30849Pimcore vulnerable to SQL Injection in Translation Export APIpimcore

CVE-2023-30848Pimcore SQL Injection Vulnerability in Admin Search Find APIpimcore

CVE-2023-2984Path Traversal: '\..\filename' in pimcore/pimcorepimcore/pimcore

CVE-2023-2983Privilege Defined With Unsafe Actions in pimcore/pimcorepimcore/pimcore

CVE-2023-28850Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective namepimcore perspective-editor

CVE-2023-2881Storing Passwords in a Recoverable Format in pimcore/customer-data-frameworkpimcore/customer-data-framework

CVE-2023-28438Pimcore vulnerable to improper quoting of filters in Custom Reportspimcore

CVE-2023-28429Pimcore has Cross-site Scripting vulnerability in DataObject tooltip fieldpimcore

CVE-2023-28108Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Modelpimcore

CVE-2023-28106Pimcore vulnerable to Cross-site Scripting in UrlSlug Data typepimcore

CVE-2023-2756SQL Injection in pimcore/customer-data-frameworkpimcore/customer-data-framework

CVE-2023-2730Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-2630Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-2629Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-frameworkpimcore/customer-data-framework

CVE-2023-2616Cross-site Scripting (XSS) - Generic in pimcore/pimcorepimcore/pimcore

CVE-2023-2615Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2023-2614Cross-site Scripting (XSS) - DOM in pimcore/pimcorepimcore/pimcore

CVE-2023-23937Missing file upload type validation in pimcore/pimcorepimcore

CVE-2023-2361Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-2343Cross-site Scripting (XSS) - DOM in pimcore/pimcorepimcore/pimcore

CVE-2023-2342Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2023-2341Cross-site Scripting (XSS) - Generic in pimcore/pimcorepimcore/pimcore

CVE-2023-2340Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-2339Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2023-2338SQL Injection in pimcore/pimcorepimcore/pimcore

CVE-2023-2336Path Traversal in pimcore/pimcorepimcore/pimcore

CVE-2023-2332Stored Cross-site Scripting (XSS) in pimcore/pimcorepimcore/pimcore

CVE-2023-2328Cross-site Scripting (XSS) - Generic in pimcore/pimcorepimcore/pimcore

CVE-2023-2327Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-2323Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-2322Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-1704Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-1703Cross-site Scripting (XSS) - Generic in pimcore/pimcorepimcore/pimcore

CVE-2023-1702Cross-site Scripting (XSS) - Generic in pimcore/pimcorepimcore/pimcore

CVE-2023-1701Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2023-1578SQL Injection in pimcore/pimcorepimcore/pimcore

CVE-2023-1517Cross-site Scripting (XSS) - DOM in pimcore/pimcorepimcore/pimcore

CVE-2023-1515Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-1429Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2023-1312Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2023-1286Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-1117Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-1116Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-1115Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-1067Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-0827Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2023-0323Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-39365RCE vulnerability in Pimcore/Mail & Dynamic Text Layoutpimcore

CVE-2022-3255Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2022-3211Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-31092SQL injection in pimcorepimcore

CVE-2022-2796Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-1429SQL injection in GridHelperService.php in pimcore/pimcorepimcore/pimcore

CVE-2022-1351Stored XSS in Tooltip in pimcore/pimcorepimcore/pimcore

CVE-2022-1339SQL injection in ElementController.php in pimcore/pimcorepimcore/pimcore

CVE-2022-1219SQL injection in RecyclebinController.php in pimcore/pimcorepimcore/pimcore

CVE-2022-0955Cross-site Scripting (XSS) - Stored in pimcore/data-hubpimcore/data-hub

CVE-2022-0911Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0894Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0893Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0832Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0831Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0705Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0704Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0665Path Traversal in pimcore/pimcorepimcore/pimcore

CVE-2022-0565Cross-site Scripting in pimcore/pimcorepimcore/pimcore

CVE-2022-0510Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2022-0509Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0348Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0285Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0263Unrestricted Upload of File with Dangerous Type in pimcore/pimcorepimcore/pimcore

CVE-2022-0262Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0260Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0258SQL Injection in pimcore/pimcorepimcore/pimcore

CVE-2022-0257Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0256Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2022-0251Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2021-4146Business Logic Errors in pimcore/pimcorepimcore/pimcore

CVE-2021-4139Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2021-4084Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore

CVE-2021-4082Cross-Site Request Forgery (CSRF) in pimcore/pimcorepimcore/pimcore

CVE-2021-4081Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore

CVE-2021-39189Observable Response Discrepancy in Lost Password Servicepimcore

CVE-2021-39170Improper Encoding or Escaping of Output in Asset Metadata Componentpimcore

CVE-2021-39166Improper Neutralization of Text-Values in Object Version Previewpimcore

CVE-2021-37702Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcorepimcore

CVE-2021-31869Pimcore AdminBundle 'specificID' SQL InjectionPimcore AdminBundle

CVE-2021-31867Pimcore Customer Data Framework 'SegmentAssignmentController.php' Blind SQL InjectionPimcore Customer Data Framework

CVE-2021-23405SQL Injectionn/a pimcore/pimcore

CVE-2021-23340Local File Inclusionn/a pimcore/pimcore

CVE-2020-7759SQL Injectionn/a pimcore/pimcore

CVE-2020-26246Authorization bypass in Pimcorepimcore

CVE-2019-10763no title heldn/a pimcore/pimcore

155 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.