Skip to content
OpenAdvisories

Vendor

coreshop

4 known vulnerabilities.

Products

CoreShop 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-108697

    CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction

    CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacki…

    coreshop CoreShop
  • Medium 6.9
    CVE-2026-23959

    CoreShop Vulnerable to SQL Injection via Admin customer-company-modifier

    CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransformerController` within the CoreShop admin panel. The affected endpoint improperly interpolates user-…

    coreshop CoreShop coreshop/core-shop Packagist
  • Medium 4.9
    CVE-2026-22242

    CoreShop Vulnerable to SQL Injection via Admin Reports

    CoreShop is a Pimcore enhanced eCommerce solution. Prior to version 4.1.8, a blind SQL injection vulnerability exists in the application that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techn…

    coreshop CoreShop coreshop/core-shop Packagist