EUVD-2026-45274

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.6, the columnConfigAction endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php passes malicious SQL configuration through CustomReportController:columnConfigAction,...

SQL Injection

pimcore/pimcore is vulnerable to SQL injection. The vulnerability is due to improper sanitization of user-supplied SQL configuration in the columnConfigAction endpoint, which is concatenated into database queries, allowing an attacker with the reportsconfig permission to execute arbitrary SELECT ...

Incorrect authorization for Reports configuration in Guardian/CMC before 24.2.0

Summary An access control vulnerability was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited privileges. Impact If a logged-in user with reporting privileges learns how to create a specific application request, they might be...

The vulnerability of the Reports Configuration sub-component of the Oracle Applications Technology component of the Oracle E-Business Suite allows a perpetrator to access confidential information.

The vulnerability of the Reports Configuration sub-component of the Oracle Applications Technology component in the Oracle E-Business Suite system relates to insufficient validation of input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain access to read, modify...

CVE-2023-22004

Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite component: Reports Configuration. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2023-22004

Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite component: Reports Configuration. Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2023-22004

CVE-2023-22004 affects Oracle E-Business Suite, specifically the Reports Configuration component of Oracle Applications Technology. Affected versions are 12.2.3–12.2.12. The flaw allows an unauthenticated attacker with network access via HTTP to compromise Oracle Applications Technology; exploita...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a set of fully integrated global business management software from Oracle Oracle. The software provides customer relationship management, service management, financial management, and other functions. A security vulnerability exists in the Oracle...

CVE-2014-4285

Unspecified vulnerability in the Oracle Applications Technology component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to Reports Configuration...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Applications Technology component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to Reports Configuration...

CVE-2014-4285

Unspecified vulnerability in the Oracle Applications Technology component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to Reports Configuration...