Log in Start free

Pimcore

Products

ProductCVEsExploitedLatest
pimcore/pimcore75–Nov 15, 2024
Pimcore45–Oct 12, 2026
admin-ui-classic-bundle12–Apr 8, 2025
pimcore/customer-data-framework5–Aug 3, 2023
customer-data-framework5–Jan 28, 2025
pimcore admin-ui-classic-bundle1–Aug 11, 2026
Pimcore AdminBundle1–Aug 4, 2021
Pimcore Customer Data Framework1–Aug 4, 2021
perspective-editor1–Apr 3, 2023
pimcore/data-hub1–Mar 24, 2022
pimcore/demo1–Sep 26, 2023
pimcore/admin-ui-classic-bundle1–Oct 30, 2023
ecommerce-framework-bundle1–Jan 11, 2024

Exploited and recent CVEs

  • CVE-2026-109392 Medium 5.4 Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview 0.2%
  • CVE-2026-55416 High 8.8 Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization 0.7%
  • CVE-2026-55072 High 8.5 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name 0.4%
  • CVE-2026-55634 Critical 9.9 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name 0.7%
  • CVE-2026-55220 Critical 9.3 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column 0.7%
  • CVE-2026-44741 High 8.8 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter 0.5%
  • CVE-2026-72562 High 8.8 Pimcore pimcore admin-ui-classic-bundle - SQL Injection 0.4%
  • CVE-2026-45704 High 7.1 Pimcore: CustomReports Share Bypass 0.4%
  • CVE-2026-44739 High 8.7 Pimcore: SQL Injection in Custom Reports Column Configuration 0.4%
  • CVE-2026-45260 High 8.1 Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling 0.6%
  • CVE-2026-45703 Medium 6.4 Pimcore: WordExport Authorization Bypass for Unauthorized Document Export 0.3%
  • CVE-2026-45162 High 8.0 Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction 1.0%
  • CVE-2026-55207 High 8.8 Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass 0.7%
  • CVE-2026-55208 High 7.7 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes 0.4%
  • CVE-2026-55212 High 7.1 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation 0.4%
  • CVE-2026-5362 Medium 4.8 Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering 0.2%
  • CVE-2026-5394 High 7.0 Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling 0.4%
  • CVE-2026-27461 Medium 6.9 Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause 0.5%
  • CVE-2026-23496 Medium 5.4 Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization 0.3%
  • CVE-2026-23494 Medium 4.3 Pimcore is Missing Function Level Authorization on "Static Routes" Listing 0.3%
  • CVE-2026-23495 Medium 4.3 Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing 0.4%
  • CVE-2026-23493 High 8.6 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log 0.4%
  • CVE-2026-23492 High 8.8 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 0.5%
  • CVE-2025-30166 Low 1.8 Pimcore's Admin Classic Bundle allows HTML Injection 0.3%
  • CVE-2025-27617 Medium 6.3 Pimcore Vulnerable to SQL Injection in getRelationFilterCondition 0.5%
  • CVE-2025-24980 Medium 6.9 Pimcore Admin Classic Bundle allows user enumeration 0.5%
  • CVE-2024-11956 Medium 4.7 Pimcore customer-data-framework list sql injection 0.9%
  • CVE-2023-2332 Medium 4.0 Stored Cross-site Scripting (XSS) in pimcore/pimcore 0.4%
  • CVE-2024-49370 High 8.7 Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing 0.5%
  • CVE-2024-41109 Medium 6.3 Pimcore vulnerable to disclosure of system and database information behind /admin firewall 0.5%