CVE-2023-2341

Cross-site Scripting XSS - Generic in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2025-27617 Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue...

CVE-2022-1339

SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data...

CVE-2022-1429

SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data...

GHSA-8M8M-98C9-VW7Q Duplicate Advisory: pimcore/customer-data-framework vulnerable to SQL Injection: Hibernate

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q53r-9hh9-w277. This link is maintained to preserve external references. Original Description A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0...

PT-2023-31900 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/demo versions prior to 10.3.0 Description: The issue concerns excessive data query operations in a large data table. Additionally, introspection is enabled on the demo site demo.pimcore.fun, which allows users to run introspection...

GHSA-VMPV-QJHQ-R463 Pimcore Cross-site Scripting vulnerability

Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4...

CVE-2023-2615 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21...

PT-2023-20536 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.21 Description: This issue allows for Cross-site Scripting XSS, which can potentially steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users...

PT-2023-18937 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.21 Description: This issue is related to Cross-site Scripting XSS - DOM, which has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or...

CVE-2023-2328 Cross-site Scripting (XSS) - Generic in pimcore/pimcore

Cross-site Scripting XSS - Generic in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2323 Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting XSS - Stored in GitHub repository pimcore/pimcore prior to 10.5.21...

GHSA-GH4G-65F6-84G5 pimcore is vulnerable to cross-site scripting

Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19...

CVE-2023-1312 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19...

PT-2023-16552 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 1.5.17 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation, allowing attackers to inject malicious scripts. Thi...

Cross-site Scripting pimcore

pimcore version 10.3.0 and prior is vulnerable to cross-site scripting...

pimcore is vulnerable to SQL Injection

pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...

GHSA-3P85-P4QG-HCRP pimcore is vulnerable to Cross-site Scripting

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

File-Upload Restrictions Bypass

pimcore/pimcore is vulnerable to file-upload restrictions bypass. The vulnerability exists as it was possible to upload a file with its filename longer than 255 characters to have the .txt removed, bypassing the .txt only restrictions...