Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization

Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

SQL Injection in Admin Grid Filter API in Pimcore

Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction

Path Traversal: '\..\filename' in pimcore/pimcore

Privilege Defined With Unsafe Actions in pimcore/pimcore

Pimcore SQL Injection Vulnerability in Admin Translations API

Pimcore vulnerable to SQL Injection in Translation Export API

Pimcore SQL Injection Vulnerability in Admin Search Find API

SQL Injection in pimcore/pimcore

SQL Injection in pimcore/pimcore

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code

SQL Injection in pimcore/pimcore

Pimcore is an open source data & experience management platform

This affects the package pimcore/pimcore before 10.0.7

In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic…

In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked…

An issue was discovered in Pimcore before 5.7.1

Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-csrf-token anti-CSRF token only in the…

Pimcore: SQL Injection in Custom Reports Column Configuration

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

SQL injection in pimcore

Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

Pimcore vulnerable to improper quoting of filters in Custom Reports

Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model

Unrestricted Upload of File with Dangerous Type in pimcore/pimcore

Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

Pimcore Vulnerable to Flooding Server with Thumbnail files

Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php

SQL injection in GridHelperService.php in pimcore/pimcore

SQL injection in ElementController.php in pimcore/pimcore

SQL injection in RecyclebinController.php in pimcore/pimcore

Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application

Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and…

Pimcore customer-data-framework list sql injection

SQL Injection in pimcore/pimcore

SQL Injection in pimcore/pimcore

The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController

Pimcore: CustomReports Share Bypass

Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

This affects the package pimcore/pimcore before 6.8.8

Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling