High severity · published Aug 11, 2026
CVE-2026-72562
Pimcore pimcore admin-ui-classic-bundle - SQL Injection
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
pimcore admin-ui-classic-bundle · Pimcore
through 2.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72562
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-72562
github.com
https://github.com/pimcore/admin-ui-classic-bundle
More from pimcore admin-ui-classic-bundle
7.2
CVE-2023-5844
Unverified Password Change in pimcore/admin-ui-classic-bundle