Security
فارسی
All products

pimcore/pimcore

Composer · Package
136 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Pimcore: SQL Injection in Custom Reports via Malicious Report ConfigurationCVE-2026-55416 · GHSA-23RH-XW42-FQ82 pimcore/pimcore Composer High Fix reported
Flooding Server with Thumbnail filesCVE-2024-32871 · GHSA-277C-5VVJ-9PWX pimcore/pimcore Composer High Fix reported
Pimcore Path Traversal Vulnerability in AssetController:importServerFilesActionCVE-2023-38708 · GHSA-34HJ-V8FM-X887 pimcore/pimcore Composer Medium Fix reported
Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()CVE-2023-47637 · GHSA-72HH-XF79-429P pimcore/pimcore Composer High Fix reported
Pimcore vulnerable to improper quoting of filters in Custom ReportsCVE-2023-28438 · GHSA-VF7Q-G2PV-JXVX pimcore/pimcore Composer Medium Fix reported
Pimcore has Cross-site Scripting vulnerability in DataObject tooltip fieldCVE-2023-28429 · GHSA-RCG9-HRHX-6Q69 pimcore/pimcore Composer Medium Fix reported
Cross-site Scripting (XSS) in UrlSlug Data typeCVE-2023-28106 · GHSA-X5J3-MQ9G-8JC8 pimcore/pimcore Composer Medium Fix reported
SQL Injection in Admin Search Find APICVE-2023-30848 · GHSA-6MHM-GCPF-5GR8 pimcore/pimcore Composer High Fix reported
Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowedCVE-2026-11407 · GHSA-7P36-FQ2R-4H7R pimcore/pimcore Composer High No fix reported
Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field NameCVE-2026-55634 · GHSA-9X44-4GXF-8C25 pimcore/pimcore Composer Critical Fix reported
Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/saveCVE-2026-5394 · GHSA-R2F4-FF2P-XC64 pimcore/pimcore Composer High Fix reported
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)CVE-2026-55220 · GHSA-W23P-WRP7-CH38 pimcore/pimcore Composer Critical Fix reported
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table nameCVE-2026-55072 · GHSA-2MHJ-FHVG-V428 pimcore/pimcore Composer High Fix reported
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handlingCVE-2026-45260 · GHSA-WC7J-G8WX-M2QX pimcore/pimcore Composer High Fix reported
Pimcore has a CustomReports Share BypassCVE-2026-45704 · GHSA-JWCC-GV4M-93X6 pimcore/pimcore Composer High Fix reported
Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes RestrictionCVE-2026-45162 · GHSA-36FC-7WJG-MFVJ pimcore/pimcore Composer High Fix reported
Pimcore has a WordExport Authorization Bypass for Unauthorized Document ExportCVE-2026-45703 · GHSA-332X-R494-54FQ pimcore/pimcore Composer Medium Fix reported
Pimcore Vulnerable to SQL Injection in Custom Reports Column ConfigurationCVE-2026-44739 · GHSA-3234-GXC3-PQ6F pimcore/pimcore Composer High Fix reported
Pimcore Authenticated Stored Cross-Site Scripting (XSS) Via Search DocumentCVE-2024-11954 · GHSA-XR3M-6GQ6-22CG pimcore/pimcore Composer High Fix reported
Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcoreCVE-2021-37702 · GHSA-PP2H-95HM-HV9R pimcore/pimcore Composer Medium Fix reported