EUVD-2022-4879

🗓️ 03 Oct 2025 20:07:09Reported by EUVDType

Pimcore before version 5.3.0 has SQL Injection vulnerability via REST web service API

Reporter	Title	Published	Views	Family All 15
0day.today	Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities	16 Aug 201800:00	–	zdt
Circl	CVE-2018-14058	20 Sep 201801:59	–	circl
CNVD	Pimcore SQL Injection Vulnerability	20 Aug 201800:00	–	cnvd
CVE	CVE-2018-14058	17 Aug 201818:00	–	cve
Cvelist	CVE-2018-14058	17 Aug 201818:00	–	cvelist
Exploit DB	Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery	16 Aug 201800:00	–	exploitdb
exploitpack	Pimcore 5.2.3 - SQL Injection Cross-Site Scripting Cross-Site Request Forgery	16 Aug 201800:00	–	exploitpack
Github Security Blog	Pimcore SQLi Vulnerability	14 May 202202:36	–	github
Metasploit	Pimcore Gather Credentials via SQL Injection	19 Sep 201813:11	–	metasploit
NVD	CVE-2018-14058	17 Aug 201818:29	–	nvd

[
  {
    "enisaIdVendor": [
      {
        "id": "210dbf1f-e752-36c0-a73a-eb0a878c1a59",
        "vendor": {
          "name": "n/a"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "a1bafd41-60cd-35e3-b8c7-d807fe673796",
        "product": {
          "name": "n/a"
        },
        "product_version": "n/a"
      }
    ]
  }
]

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2018-14058
exploit-db	www.exploit-db.com/exploits/45208
sec-consult	www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software
packetstormsecurity	www.packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html
seclists	www.seclists.org/fulldisclosure/2018/Aug/13
packetstormsecurity	www.packetstormsecurity.com/files/cve/CVE-2018-14058
sec-consult	www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/
exploit-db	www.exploit-db.com/exploits/45208/

03 Oct 2025 20:07Current

6.8Medium risk

Vulners AI Score6.8

CVSS 36.5

CVSS 24

EPSS0.01507