CVE-2026-109392

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...

CVE-2026-109392

Pimcore versions through 2026.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw within the ExternalImage field. The root cause is the storage of unescaped URLs , which allows authenticated backend users with data object edit permissions to inject attribute-breaking payloads. These pa...

CVE-2026-109392 Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...

CVE-2026-109392 Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...

EUVD-2026-97490

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields. Attackers with data object edit permission can store attribute-breaking payloads that execute JavaScript in th...

GHSA-V5JP-4H2P-J2P4 Privilege Escalation in TYPO3 CMS

The workspace/ version preview link created by a privileged backend user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2021-93906)

Pimcore is a comprehensive open source enterprise platform for master data management PIM/MDM, user experience management CMS/UX, digital asset management DAM, and e-commerce. cross-site scripting vulnerabilities exist in versions of Pimcore prior to 10.1.2. The vulnerability stems from text valu...

CVE-2021-39166

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2...

PT-2021-22423

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 10.1.2 Description The issue concerns the Pimcore open source data & experience management platform. In this platform, text-values were not properly escaped before being printed in the version preview. This allowed...

CVE-2021-39166: Improper Neutralization of Input During Web Page Generation

Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2...

Pimcore cross-site scripting vulnerabilities

Pimcore is a comprehensive open source enterprise platform for master data management PIM/MDM, user experience management CMS/UX, digital asset management DAM, and e-commerce. cross-site scripting vulnerabilities exist in versions of Pimcore prior to 10.1.2. The vulnerability stems from text valu...