Login Request a demo
PI
Product
pimcore
by pimcore · last CVE Oct 12, 2026
145
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Vulnerabilities145In the news0Timeline
Severity mix
Critical 6High 45Medium 90Low 0
Severity
All severities145Critical6High45Medium90Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add pimcore to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-0827
5.4
3%
Feb 14
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 1.5.17
CVE-2023-23937
5.4
0%
Feb 3
Missing file upload type validation in pimcore/pimcore
Affected: < 10.5.16
CVE-2023-0323
5.4
0%
Jan 16
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.14
CVE-2022-3211
5.4
1%
Sep 15
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.6
CVE-2022-1351
5.4
1%
Apr 14
Stored XSS in Tooltip in pimcore/pimcore
Affected: before 10.4.0
CVE-2022-0705
5.4
1%
Mar 16
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: through 10.3.0
CVE-2022-0704
5.4
1%
Mar 16
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: through 10.3.0
CVE-2022-0911
5.4
1%
Mar 16
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: through 10.3.0
CVE-2022-0893
5.4
1%
Mar 15
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: through 10.3.0
CVE-2022-0894
5.4
1%
Mar 15
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: through 10.3.0
CVE-2022-0832
5.4
67%
Mar 4
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.3.3
CVE-2022-0831
5.4
1%
Mar 4
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.3.3
CVE-2022-0510
5.4
1%
Feb 8
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: through 10.3.0
CVE-2022-0509
5.4
1%
Feb 8
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.3.1
CVE-2022-0348
5.4
1%
Jan 27
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.2
CVE-2022-0251
5.4
1%
Jan 26
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.2.0
CVE-2022-0285
5.4
1%
Jan 20
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.2.9
CVE-2022-0260
5.4
1%
Jan 18
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.2.7
CVE-2022-0257
5.4
1%
Jan 17
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.2.8
CVE-2022-0256
5.4
1%
Jan 17
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.2.8
CVE-2021-39170
5.4
1%
Sep 1
Pimcore is an open source data & experience management platform
Affected: before 10.1.2
CVE-2021-39166
5.4
1%
Sep 1
Pimcore is an open source data & experience management platform
Affected: before 10.1.2
CVE-2018-14059
5.4
3%
Aug 24
Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined…
Affected: through 5.2.3
CVE-2021-39189
5.3
1%
Sep 15
Pimcore is an open source data & experience management platform
Affected: before 10.1.3
CVE-2026-27461
4.9
1%
Feb 24
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
Affected: <= 11.5.14.1; >= 12.0.0, < 12.3.3
CVE-2026-23493
4.9
0%
Jan 15
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
Affected: >= 12.0.0-RC1, < 12.3.1; < 11.5.14
CVE-2026-23492
4.9
0%
Jan 14
Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848
Affected: >= 12.0.0-RC1, < 12.3.1; < 11.5.14
CVE-2024-49370
4.9
1%
Oct 23
Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing
Affected: < 3.1.16; >= 4.0.0, < 4.1.7
CVE-2023-30852
4.9
1%
Apr 27
Pimcore Arbitrary File Read in Admin JS CSS files
Affected: < 10.5.21
CVE-2024-11954
4.8
1%
Jan 28
Pimcore Search Document cross site scripting
Affected: 11.4.2
CVE-2023-2332
4.8
0%
Nov 15
Stored Cross-site Scripting (XSS) in pimcore/pimcore
Affected: 10.5.19
CVE-2023-2630
4.8
1%
May 10
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.21
CVE-2023-1517
4.8
0%
Mar 20
Cross-site Scripting (XSS) - DOM in pimcore/pimcore
Affected: before 10.5.19
CVE-2023-28106
4.8
1%
Mar 16
Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type
Affected: < 10.5.19
CVE-2023-1312
4.8
0%
Mar 10
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: before 10.5.19
CVE-2023-1286
4.8
0%
Mar 9
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.19
CVE-2022-3255
4.8
1%
Sep 21
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
Affected: before 10.5.7
CVE-2022-2796
4.8
2%
Aug 23
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Affected: before 10.5.4
CVE-2026-23495
4.3
0%
Jan 15
Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing
Affected: >= 2.0.0-RC1, < 2.2.3; < 1.7.16
CVE-2021-4146
4.3
1%
Jan 18
Business Logic Errors in pimcore/pimcore
Affected: before 10.2.6
CVE-2021-4082
4.3
0%
Dec 10
Cross-Site Request Forgery (CSRF) in pimcore/pimcore
Affected: before 10.2.6
CVE-2015-4426
–
2%
Aug 18
SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy
Affected: All versions, or not specified
CVE-2015-4425
–
4%
Aug 18
Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a
Affected: All versions, or not specified
CVE-2014-2922
–
3%
Apr 21
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a…
Affected: 1.4.9; 1.5.0; 2.1.0
CVE-2014-2921
–
6%
Apr 21
The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing…
Affected: 1.4.9; 1.5.0; 2.1.0; 2.2.0
Page 3 of 3 · 145 total
123