Skip to content
OpenAdvisories

Vendor

pimcore

151 known vulnerabilities.

Products

pimcore/pimcore 75 pimcore 45 admin-ui-classic-bundle 12 Pimcore Customer Data Framework 6 customer-data-framework 5 pimcore admin-ui-classic-bundle 2 Pimcore AdminBundle 1 ecommerce-framework-bundle 1 Pimcore CMS/DXP 1 pimcore/demo 1 perspective-editor 1 pimcore/data-hub 1
All Critical High Medium Low Exploited only Public exploit

46 results · Clear filters · Feed

  • High 8.3
    CVE-2022-0258

    SQL Injection in pimcore/pimcore

    pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • High 7.4
    CVE-2021-4084

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • High 8.0
    CVE-2021-39170

    Improper Encoding or Escaping of Output in Asset Metadata Component

    Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may a…

    pimcore pimcore pimcore/pimcore Packagist
  • High 8.0
    CVE-2021-39166

    Improper Neutralization of Text-Values in Object Version Preview

    Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched …

    pimcore pimcore pimcore/pimcore Packagist
  • High 8.0
    CVE-2021-37702

    Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

    Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround.

    pimcore pimcore pimcore/pimcore Packagist
  • High 7.7
    CVE-2020-26246

    Authorization bypass in Pimcore

    Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions.

    pimcore pimcore