Skip to content
OpenAdvisories

Package · Packagist

coreshop/core-shop

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.2
    CVE-2026-41249 Public exploit

    CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure `pull_request_target` Configuration

    CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow (`.github/workflows/static.yml`) uses the `pull_request_target` trigger but dangerously checks out the unverified code from the pull reques…

    coreshop CoreShop coreshop/core-shop Packagist
  • Medium 6.9
    CVE-2026-23959

    CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier

    CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransformerController` within the CoreShop admin panel. The affected endpoint improperly interpolates user-…

    coreshop CoreShop coreshop/core-shop Packagist
  • Medium 4.9
    CVE-2026-22242

    CoreShop Vulnerable to SQL Injection via Admin Reports

    CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techn…

    coreshop CoreShop coreshop/core-shop Packagist