Package · Packagist

pimcore/pimcore

135 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

84 results · Clear filters · Feed

Medium 4.8

GHSA-2xpm-cmvw-3jcc

Reflected XSS in Application Logger module

### Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. ### Patches Update to version 10.5.19 or apply this patch manual…

pimcore/pimcore Packagist

Mar 16, 2023
Medium —

GHSA-rrwm-8wqm-gwgv

Cross-site Scripting (XSS) - stored in Print Documents

### Impact Stored xss leads to steal cookies and other information of other users ### Patches Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14560.patch ### Workarounds Apply https://github.com/pimcore/pimcore/p…

pimcore/pimcore Packagist

Mar 16, 2023
Medium 6.1

CVE-2023-28106

Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workarou…

pimcore pimcore pimcore/pimcore Packagist

Mar 16, 2023
Medium 4.0

CVE-2023-1429

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 16, 2023
Medium 5.2

CVE-2023-1312

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 10, 2023
Medium 4.8

CVE-2023-1286

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 9, 2023
Medium 4.8

CVE-2023-1117

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 1, 2023
Medium 5.4

CVE-2023-1116

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 1, 2023
Medium 5.2

CVE-2023-1067

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Feb 27, 2023
Medium —

GHSA-76r7-h46w-463r

Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug

### Impact An attacker can use XSS to send a malicious script to an unsuspecting user. ### Patches Update to version 10.5.17 or apply this patch manually https://github.com/pimcore/pimcore/pull/14301.patch ### Workarounds Apply https://github.com/pimcore/pimc…

pimcore/pimcore Packagist

Feb 15, 2023
Medium 6.3

CVE-2023-0827

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Feb 14, 2023
Medium 6.1

CVE-2023-0323

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Jan 16, 2023
Medium 6.8

CVE-2022-3255

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information…

pimcore pimcore/pimcore pimcore/pimcore Packagist

Sep 21, 2022
Medium 5.8

CVE-2022-3211

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Sep 15, 2022
Medium 6.7

CVE-2022-2796

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Aug 23, 2022
Medium 6.8

CVE-2022-1351

Stored XSS in Tooltip in pimcore/pimcore

Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Apr 14, 2022
Medium 4.2

CVE-2022-0705

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 16, 2022
Medium 4.0

CVE-2022-0704

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 16, 2022
Medium 6.8

CVE-2022-0911

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 16, 2022
Medium 6.8

CVE-2022-0893

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 15, 2022
Medium 4.6

CVE-2022-0832 EPSS 67%

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 4, 2022
Medium 4.6

CVE-2022-0831

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Mar 4, 2022
Medium 4.9

CVE-2022-0665

Path Traversal in pimcore/pimcore

Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Feb 22, 2022
Medium 4.3

CVE-2022-0510

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Feb 8, 2022
Medium 6.6

CVE-2022-0509

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Feb 8, 2022
Medium 4.3

CVE-2022-0348

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Jan 27, 2022
Medium 6.6

CVE-2022-0285

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Jan 20, 2022
Medium 6.6

CVE-2022-0263

Unrestricted Upload of File with Dangerous Type in pimcore/pimcore

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Jan 18, 2022
Medium 6.6

CVE-2022-0262

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Jan 18, 2022
Medium 4.3

CVE-2021-4146

Business Logic Errors in pimcore/pimcore

Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Jan 18, 2022
Medium 6.5

CVE-2022-0260

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7.

pimcore pimcore/pimcore pimcore/pimcore Packagist

Jan 18, 2022
Medium 6.1

CVE-2022-0257

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

pimcore pimcore/pimcore pimcore/pimcore Packagist

Jan 17, 2022
Medium 5.3

CVE-2022-0256

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

pimcore pimcore/pimcore pimcore/pimcore Packagist

Jan 17, 2022
Medium 6.6

CVE-2021-4139

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

pimcore pimcore/pimcore pimcore/pimcore Packagist

Dec 21, 2021
Medium 5.5

CVE-2021-4081

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

pimcore pimcore/pimcore pimcore/pimcore Packagist

Dec 10, 2021
Medium 4.3

CVE-2021-4082

Cross-Site Request Forgery (CSRF) in pimcore/pimcore

pimcore is vulnerable to Cross-Site Request Forgery (CSRF)

pimcore pimcore/pimcore pimcore/pimcore Packagist

Dec 10, 2021
Medium 5.3

CVE-2021-39189

Observable Response Discrepancy in Lost Password Service

Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patc…

pimcore pimcore pimcore/pimcore Packagist

Sep 15, 2021
Medium —

GHSA-cfcv-q4qq-2ph4

CKEditor 4 vulnerabilities in versions <4.16.1

Details see: https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-m94c-37g6-cjhc ( CVE-2021-37695 ) https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-6226-h7ff-ch6c ( CVE-2021-32808 ) https://github.com/ckeditor/ckeditor4/security/advis…

pimcore/pimcore Packagist

Aug 23, 2021
Medium 6.5

CVE-2020-7759

SQL Injection

The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demons…

pimcore/pimcore Packagist

Oct 30, 2020
Medium 6.5

CVE-2019-10763

Data leakage via SQL Injection in Pimcore

pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' pa…

pimcore/pimcore Packagist

Nov 18, 2019