Login Request a demo
PI
Vendor
pimcore
16 products with CVEs on record
277
CVEs
0
On KEV
1
New 30D
Products
PI
pimcore
pimcore
9.9
145 CVEs0 on KEV1 new
PI
pimcore/pimcore
pimcore
9.0
75 CVEs0 on KEV0 new
AC
Admin Classic Bundle
Pimcore
9.3
14 CVEs0 on KEV0 new
AD
admin-ui-classic-bundle
pimcore
9.3
12 CVEs0 on KEV0 new
CM
Customer Management Framework
Pimcore
7.8
9 CVEs0 on KEV0 new
CU
customer-data-framework
pimcore
7.2
7 CVEs0 on KEV0 new
PI
pimcore/customer-data-framework
pimcore
7.8
5 CVEs0 on KEV0 new
PI
pimcore/admin-ui-classic-bundle
pimcore
8.8
2 CVEs0 on KEV0 new
CO
Core
Pimcore
6.5
1 CVEs0 on KEV0 new
DA
Data-hub
Pimcore
4.8
1 CVEs0 on KEV0 new
EF
E-commerce Framework
Pimcore
4.3
1 CVEs0 on KEV0 new
EC
ecommerce-framework-bundle
pimcore
4.3
1 CVEs0 on KEV0 new
PE
perspective-editor
pimcore
5.4
1 CVEs0 on KEV0 new
PI
pimcore/data-hub
pimcore
4.8
1 CVEs0 on KEV0 new
PI
pimcore/demo
pimcore
6.5
1 CVEs0 on KEV0 new
WT
Web2print Tools
Pimcore
5.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-109392
PI
Pimcore
Pimcore
5.4
0%
Oct 12Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
CVE-2026-55416
PI
pimcore
pimcore
8.8
1%
Sep 14Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization
CVE-2026-55072
PI
pimcore
pimcore
8.5
0%
Sep 14Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
CVE-2026-55634
PI
pimcore
pimcore
9.9
1%
Aug 28Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
CVE-2026-55220
PI
pimcore
pimcore
9.3
1%
Aug 28Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column
CVE-2026-44741
PI
pimcore
pimcore
8.8
0%
Aug 12Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
CVE-2026-72562
PA
pimcore admin-ui-classic-bundle
Pimcore
8.8
0%
Aug 11Pimcore pimcore admin-ui-classic-bundle - SQL Injection
CVE-2026-45704
PI
pimcore
pimcore
7.1
0%
Jul 17Pimcore: CustomReports Share Bypass
CVE-2026-44739
PI
pimcore
pimcore
8.7
0%
Jul 17Pimcore: SQL Injection in Custom Reports Column Configuration
CVE-2026-45260
PI
pimcore
pimcore
8.1
1%
Jul 17Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
CVE-2026-45703
PI
pimcore
pimcore
6.4
0%
Jul 17Pimcore: WordExport Authorization Bypass for Unauthorized Document Export
CVE-2026-45162
PI
pimcore
pimcore
8.0
1%
Jul 17Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
CVE-2026-55207
PI
pimcore
pimcore
8.8
1%
Jul 9Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
CVE-2026-55208
PI
pimcore
pimcore
7.7
0%
Jul 9Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
CVE-2026-55212
PI
pimcore
pimcore
7.1
0%
Jul 9Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
CVE-2026-5362
PI
pimcore
pimcore
5.4
0%
Apr 27Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering
CVE-2026-5394
PI
pimcore
pimcore
7.0
0%
Apr 27Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling
CVE-2026-27461
PI
pimcore
pimcore
4.9
1%
Feb 24Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
CVE-2026-23496
PI
pimcore
pimcore
5.4
0%
Jan 15Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
CVE-2026-23494
PI
pimcore
pimcore
6.5
0%
Jan 15Pimcore is Missing Function Level Authorization on "Static Routes" Listing
CVE-2026-23495
PI
pimcore
pimcore
4.3
0%
Jan 15Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing
CVE-2026-23493
PI
pimcore
pimcore
4.9
0%
Jan 15Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
CVE-2026-23492
PI
pimcore
pimcore
4.9
0%
Jan 14Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848
CVE-2025-30166
AD
admin-ui-classic-bundle
pimcore
4.8
0%
Apr 8Pimcore's Admin Classic Bundle allows HTML Injection
CVE-2025-27617
PI
pimcore
pimcore
8.8
0%
Mar 11Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
CVE-2025-24980
AD
admin-ui-classic-bundle
pimcore
5.3
1%
Feb 7Pimcore Admin Classic Bundle allows user enumeration
CVE-2024-11956
CU
customer-data-framework
Pimcore
7.2
1%
Jan 28Pimcore customer-data-framework list sql injection
CVE-2024-11954
PI
Pimcore
Pimcore
4.8
1%
Jan 28Pimcore Search Document cross site scripting
CVE-2023-2332
PI
pimcore/pimcore
pimcore
4.8
0%
Nov 15Stored Cross-site Scripting (XSS) in pimcore/pimcore
CVE-2024-49370
PI
pimcore
pimcore
4.9
1%
Oct 23Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing
CVE-2024-41109
AD
admin-ui-classic-bundle
pimcore
6.5
0%
Jul 30Pimcore vulnerable to disclosure of system and database information behind /admin firewall
CVE-2024-32871
PI
pimcore
pimcore
7.5
1%
Jun 4Pimcore Vulnerable to Flooding Server with Thumbnail files
CVE-2024-29197
PI
pimcore
pimcore
6.5
1%
Mar 26Pimcore Preview Documents are not restricted to logged in users anymore
CVE-2024-25625
AD
admin-ui-classic-bundle
pimcore
9.3
1%
Feb 19Pimcore Host Header Injection in user invitation link
CVE-2024-24822
AD
admin-ui-classic-bundle
pimcore
9.1
1%
Feb 7Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
CVE-2024-23646
AD
admin-ui-classic-bundle
pimcore
8.8
1%
Jan 24Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
CVE-2024-23648
AD
admin-ui-classic-bundle
pimcore
8.8
1%
Jan 24Pimcore Admin Classic Bundle host header injection in the password reset
CVE-2024-21667
CU
customer-data-framework
pimcore
6.5
1%
Jan 11Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts
CVE-2024-21666
CU
customer-data-framework
pimcore
6.5
1%
Jan 11Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list
CVE-2024-21665
EC
ecommerce-framework-bundle
pimcore
4.3
0%
Jan 11Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list
CVE-2023-49076
CU
customer-data-framework
pimcore
6.5
0%
Nov 30Pimcore missing token/header to prevent CSRF
CVE-2023-49075
AD
admin-ui-classic-bundle
pimcore
7.2
1%
Nov 28Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
CVE-2023-47636
AD
admin-ui-classic-bundle
pimcore
5.3
1%
Nov 15Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle
CVE-2023-47637
PI
pimcore
pimcore
8.8
1%
Nov 15SQL Injection in Admin Grid Filter API in Pimcore
CVE-2023-46722
AD
admin-ui-classic-bundle
pimcore
6.1
0%
Oct 31Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews
CVE-2023-5873
PI
pimcore/pimcore
pimcore
5.4
0%
Oct 31Cross-site Scripting (XSS) - Stored in pimcore/pimcore
CVE-2023-5844
PI
pimcore/admin-ui-classic-bundle
pimcore
7.2
1%
Oct 30Unverified Password Change in pimcore/admin-ui-classic-bundle
CVE-2023-5192
PI
pimcore/demo
pimcore
6.5
1%
Sep 26Excessive Data Query Operations in a Large Data Table in pimcore/demo
CVE-2023-42817
AD
admin-ui-classic-bundle
pimcore
5.4
0%
Sep 25Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations
CVE-2023-4453
PI
pimcore/pimcore
pimcore
5.4
1%
Aug 21Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
CVE-2023-38708
PI
pimcore
pimcore
8.8
1%
Aug 4Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction
CVE-2023-4145
PI
pimcore/customer-data-framework
pimcore
5.4
1%
Aug 3Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework
CVE-2023-3822
PI
pimcore/pimcore
pimcore
6.1
1%
Jul 21Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
CVE-2023-3821
PI
pimcore/pimcore
pimcore
5.4
1%
Jul 21Cross-site Scripting (XSS) - Stored in pimcore/pimcore
CVE-2023-3820
PI
pimcore/pimcore
pimcore
7.2
1%
Jul 21SQL Injection in pimcore/pimcore
CVE-2023-3819
PI
pimcore/pimcore
pimcore
6.5
1%
Jul 21Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore
CVE-2023-3673
PI
pimcore/pimcore
pimcore
7.2
1%
Jul 14SQL Injection in pimcore/pimcore
CVE-2023-37280
AD
admin-ui-classic-bundle
pimcore
6.1
1%
Jul 11Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page
CVE-2023-3574
PI
pimcore/customer-data-framework
pimcore
6.5
1%
Jul 10Improper Authorization in pimcore/customer-data-framework
CVE-2023-2983
PI
pimcore/pimcore
pimcore
8.8
1%
May 30Privilege Defined With Unsafe Actions in pimcore/pimcore