CVE-2023-47637

Pimcore contains a SQL injection in the Admin Grid Filter API. In affected versions, the /admin/object/grid-proxy endpoint calls getFilterCondition() on class fields to build SQL from user input, and Multiselect’s implementation does not normalize/escape/validate that input. This allows any backe...

CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore

Pimcore is an Open Source Data & Experience Management Platform. In affected versions the /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of getFilterConditi...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

✍️ Description pimcore is a Open Source Data & Experience Management Platform PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce this package is vulnerable for Stored XSS thru gender tag 🕵️‍♂️ Proof of Concept 💥 Impact This vulnerability is capable of stored xss 📍 Location Gender.phpL21...