Login Request a demo
PI
Product
pimcore
by pimcore · last CVE Oct 12, 2026
145
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Vulnerabilities145In the news0Timeline
Severity mix
Critical 6High 45Medium 90Low 0
Severity
All severities145Critical6High45Medium90Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add pimcore to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-5394
7.0
0%
Apr 27
Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling
Affected: 12.3.3
CVE-2026-23494
6.5
0%
Jan 15
Pimcore is Missing Function Level Authorization on "Static Routes" Listing
Affected: >= 12.0.0-RC1, < 12.3.1; < 11.5.14
CVE-2024-29197
6.5
1%
Mar 26
Pimcore Preview Documents are not restricted to logged in users anymore
Affected: >= 11.0.0, < 11.1.6.1; >= 11.2.0, < 11.2.2
CVE-2023-49076
6.5
0%
Nov 30
Pimcore missing token/header to prevent CSRF
Affected: before 4.0.5
CVE-2023-5192
6.5
1%
Sep 26
Excessive Data Query Operations in a Large Data Table in pimcore/demo
Affected: before 10.3.0
CVE-2023-3819
6.5
1%
Jul 21
Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore
Affected: before 10.6.4
CVE-2023-2336
6.5
1%
Apr 27
Path Traversal in pimcore/pimcore
Affected: before 10.5.21
CVE-2022-0665
6.5
2%
Feb 22
Path Traversal in pimcore/pimcore
Affected: before 10.3.2
CVE-2020-26246
6.5
1%
Dec 3
Pimcore is an open source digital experience platform
Affected: before 6.8.5
CVE-2019-10763
6.5
1%
Nov 18
pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection
Affected: before 6.3.0
CVE-2018-14058
6.5
29%
Aug 17
Pimcore before 5.3.0 allows SQL Injection via the REST web service API
Affected: before 5.3.0
CVE-2026-45703
6.4
0%
Jul 17
Pimcore: WordExport Authorization Bypass for Unauthorized Document Export
Affected: < 11.5.17; >= 12.0.0, < 12.3.7
CVE-2022-0565
6.4
1%
Feb 12
Cross-site Scripting in pimcore/pimcore
Affected: before 10.3.1
CVE-2023-3822
6.1
1%
Jul 21
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: before 10.6.4
CVE-2023-2341
6.1
1%
Apr 27
Cross-site Scripting (XSS) - Generic in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-28429
6.1
1%
Mar 20
Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field
Affected: < 10.5.19
CVE-2022-0262
6.1
2%
Jan 18
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.2.7
CVE-2021-4084
6.1
2%
Dec 10
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.2.6
CVE-2021-4081
6.1
1%
Dec 10
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: before 10.2.6
CVE-2019-18982
6.1
1%
Nov 15
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a…
Affected: 6.0.0 before 6.3.0
CVE-2019-18656
6.1
1%
Oct 31
Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements
Affected: 6.2.3
CVE-2026-109392
5.4
0%
Oct 12
Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
Affected: through 2026.3.1
CVE-2026-5362
5.4
0%
Apr 27
Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering
Affected: v12.3.3
CVE-2026-23496
5.4
0%
Jan 15
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
Affected: >= 6.0.0-RC1, < 6.1.1; < 5.2.2
CVE-2023-5873
5.4
0%
Oct 31
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 11.1.0
CVE-2023-4453
5.4
1%
Aug 21
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: before 10.6.8
CVE-2023-3821
5.4
1%
Jul 21
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.6.4
CVE-2023-2730
5.4
0%
May 16
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.3.3
CVE-2023-2615
5.4
0%
May 10
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2616
5.4
0%
May 10
Cross-site Scripting (XSS) - Generic in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2614
5.4
0%
May 10
Cross-site Scripting (XSS) - DOM in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2361
5.4
0%
Apr 28
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2322
5.4
1%
Apr 27
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2323
5.4
1%
Apr 27
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2327
5.4
0%
Apr 27
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2328
5.4
0%
Apr 27
Cross-site Scripting (XSS) - Generic in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2339
5.4
1%
Apr 27
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2340
5.4
0%
Apr 27
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2342
5.4
0%
Apr 27
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-2343
5.4
0%
Apr 27
Cross-site Scripting (XSS) - DOM in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-1704
5.4
0%
Mar 29
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.20
CVE-2023-1703
5.4
0%
Mar 29
Cross-site Scripting (XSS) - Generic in pimcore/pimcore
Affected: before 10.5.20
CVE-2023-1702
5.4
0%
Mar 29
Cross-site Scripting (XSS) - Generic in pimcore/pimcore
Affected: before 10.5.20
CVE-2023-1701
5.4
0%
Mar 29
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: before 10.5.20
CVE-2023-1515
5.4
0%
Mar 20
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.19
CVE-2023-1429
5.4
0%
Mar 16
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: before 10.5.19
CVE-2023-1115
5.4
1%
Mar 1
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.18
CVE-2023-1116
5.4
1%
Mar 1
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.18
CVE-2023-1117
5.4
0%
Mar 1
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.18
CVE-2023-1067
5.4
0%
Feb 27
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.18
Page 2 of 3 · 145 total
123