PI
Product
pimcore
145
CVEs
0
On KEV
9.9
Max CVSS
1
New 30D
Severity mix
Critical 6High 45Medium 90Low 0
Watch
Add pimcore to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-0827 | 5.4 | Feb 14 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore Affected: before 1.5.17 |
| CVE-2023-23937 | 5.4 | Feb 3 | Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce Affected: before 10.5.16 |
| CVE-2023-0323 | 5.4 | Jan 16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14 Affected: before 10.5.14 |
| CVE-2022-3211 | 5.4 | Sep 15 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6 Affected: before 10.5.6 |
| CVE-2022-1351 | 5.4 | Apr 14 | Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4 Affected: before 10.4.0 |
| CVE-2022-0705 | 5.4 | Mar 16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0 Affected: through 10.3.0 |
| CVE-2022-0704 | 5.4 | Mar 16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0 Affected: through 10.3.0 |
| CVE-2022-0911 | 5.4 | Mar 16 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0 Affected: through 10.3.0 |
| CVE-2022-0894 | 5.4 | Mar 15 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0 Affected: through 10.3.0 |
| CVE-2022-0893 | 5.4 | Mar 15 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0 Affected: through 10.3.0 |
| CVE-2022-0832 | 5.4 | Mar 4 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3 Affected: before 10.3.3 |
| CVE-2022-0831 | 5.4 | Mar 4 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3 Affected: before 10.3.3 |
| CVE-2022-0510 | 5.4 | Feb 8 | Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1 Affected: through 10.3.0 |
| CVE-2022-0509 | 5.4 | Feb 8 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1 Affected: before 10.3.1 |
| CVE-2022-0348 | 5.4 | Jan 27 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2 Affected: before 10.2 |
| CVE-2022-0251 | 5.4 | Jan 26 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10 Affected: before 10.2.0 |
| CVE-2022-0285 | 5.4 | Jan 20 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9 Affected: before 10.2.9 |
| CVE-2022-0260 | 5.4 | Jan 18 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7 Affected: before 10.2.7 |
| CVE-2022-0257 | 5.4 | Jan 17 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected: before 10.2.8 |
| CVE-2022-0256 | 5.4 | Jan 17 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected: before 10.2.8 |
| CVE-2021-39170 | 5.4 | Sep 1 | Pimcore is an open source data & experience management platform Affected: before 10.1.2 |
| CVE-2021-39166 | 5.4 | Sep 1 | Pimcore is an open source data & experience management platform Affected: before 10.1.2 |
| CVE-2018-14059 | 5.4 | Aug 24 | Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined… Affected: through 5.2.3 |
| CVE-2021-39189 | 5.3 | Sep 15 | Pimcore is an open source data & experience management platform Affected: before 10.1.3 |
| CVE-2026-27461 | 4.9 | Feb 24 | Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause Affected: <= 11.5.14.1; >= 12.0.0, < 12.3.3 |
| CVE-2026-23493 | 4.9 | Jan 15 | Pimcore ENV Variables and Cookie Informations are exposed in http_error_log Affected: >= 12.0.0-RC1, < 12.3.1; < 11.5.14 |
| CVE-2026-23492 | 4.9 | Jan 14 | Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 Affected: >= 12.0.0-RC1, < 12.3.1; < 11.5.14 |
| CVE-2024-49370 | 4.9 | Oct 23 | Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing Affected: < 3.1.16; >= 4.0.0, < 4.1.7 |
| CVE-2023-30852 | 4.9 | Apr 27 | Pimcore Arbitrary File Read in Admin JS CSS files Affected: < 10.5.21 |
| CVE-2024-11954 | 4.8 | Jan 28 | Pimcore Search Document cross site scripting Affected: 11.4.2 |
| CVE-2023-2332 | 4.8 | Nov 15 | Stored Cross-site Scripting (XSS) in pimcore/pimcore Affected: 10.5.19 |
| CVE-2023-2630 | 4.8 | May 10 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore Affected: before 10.5.21 |
| CVE-2023-1517 | 4.8 | Mar 20 | Cross-site Scripting (XSS) - DOM in pimcore/pimcore Affected: before 10.5.19 |
| CVE-2023-28106 | 4.8 | Mar 16 | Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type Affected: < 10.5.19 |
| CVE-2023-1312 | 4.8 | Mar 10 | Cross-site Scripting (XSS) - Reflected in pimcore/pimcore Affected: before 10.5.19 |
| CVE-2023-1286 | 4.8 | Mar 9 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore Affected: before 10.5.19 |
| CVE-2022-3255 | 4.8 | Sep 21 | If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user Affected: before 10.5.7 |
| CVE-2022-2796 | 4.8 | Aug 23 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4 Affected: before 10.5.4 |
| CVE-2026-23495 | 4.3 | Jan 15 | Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing Affected: >= 2.0.0-RC1, < 2.2.3; < 1.7.16 |
| CVE-2021-4146 | 4.3 | Jan 18 | Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6 Affected: before 10.2.6 |
| CVE-2021-4082 | 4.3 | Dec 10 | pimcore is vulnerable to Cross-Site Request Forgery (CSRF) Affected: before 10.2.6 |
| CVE-2015-4426 | – | Aug 18 | SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy Affected: All versions, or not specified |
| CVE-2015-4425 | – | Aug 18 | Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a Affected: All versions, or not specified |
| CVE-2014-2922 | – | Apr 21 | The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a… Affected: 1.4.9; 1.5.0; 2.1.0 |
| CVE-2014-2921 | – | Apr 21 | The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing… Affected: 1.4.9; 1.5.0; 2.1.0; 2.2.0 |