CVE-2026-55416Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization Exploitation status Not known exploited Fix Affected product P pimcore Published 09/14/2026 Severity High CVE-2026-55072Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name Exploitation status Public exploit Fix Affected product P pimcore Published 09/14/2026 Severity High CVE-2026-55634Pimcore: Remote Code Execution via DataObject Class-Definition Field Name Exploitation status Public exploit Fix Affected product P pimcore Published 08/28/2026 Severity Critical CVE-2026-55220Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 08/28/2026 Severity Critical CVE-2026-44741Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter Exploitation status Public exploit Fix Not confirmed Affected product P pimcore Published 08/12/2026 Severity High CVE-2026-72562Pimcore pimcore admin-ui-classic-bundle - SQL Injection Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore/admin-ui-classic-bundle Published 08/11/2026 Severity High CVE-2026-45704Pimcore: CustomReports Share Bypass Exploitation status Public exploit Fix Affected product P pimcore Published 07/17/2026 Severity High CVE-2026-44739Pimcore: SQL Injection in Custom Reports Column Configuration Exploitation status Public exploit Fix Affected product P pimcore Published 07/17/2026 Severity High CVE-2026-45260Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling Exploitation status Public exploit Fix Affected product P pimcore Published 07/17/2026 Severity High CVE-2026-45703Pimcore: WordExport Authorization Bypass for Unauthorized Document Export Exploitation status Public exploit Fix Affected product P pimcore Published 07/17/2026 Severity Medium CVE-2026-45162Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction Exploitation status Public exploit Fix Affected product P pimcore Published 07/17/2026 Severity High CVE-2026-55207Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass Exploitation status Public exploit Fix Affected product P pimcore Published 07/09/2026 Severity High CVE-2026-55208Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes Exploitation status Public exploit Fix Affected product P pimcore Published 07/09/2026 Severity High CVE-2026-55212Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation Exploitation status Public exploit Fix Affected product P pimcore Published 07/09/2026 Severity High CVE-2026-5362Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 04/27/2026 Severity Medium CVE-2026-5394Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling Exploitation status Not known exploited Fix Affected product P pimcore Published 04/27/2026 Severity High CVE-2026-27461Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause Exploitation status Public exploit Fix Not confirmed Affected product P pimcore Published 02/24/2026 Severity Medium CVE-2026-23496Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization Exploitation status Public exploit Fix Affected product P pimcore Published 01/15/2026 Severity Medium CVE-2026-23494Pimcore is Missing Function Level Authorization on "Static Routes" Listing Exploitation status Public exploit Fix Affected product P pimcore Published 01/15/2026 Severity Medium CVE-2026-23495Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing Exploitation status Public exploit Fix Affected product P pimcore Published 01/15/2026 Severity Medium CVE-2026-23493Pimcore ENV Variables and Cookie Informations are exposed in http_error_log Exploitation status Public exploit Fix Affected product P pimcore Published 01/15/2026 Severity High CVE-2026-23492Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 Exploitation status Public exploit Fix Affected product P pimcore Published 01/14/2026 Severity High CVE-2025-30166Pimcore's Admin Classic Bundle allows HTML Injection Exploitation status Public exploit Fix Affected product A admin-ui-classic-bundle Published 04/08/2025 Severity Low CVE-2025-27617Pimcore Vulnerable to SQL Injection in getRelationFilterCondition Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 03/11/2025 Severity Medium CVE-2025-24980Pimcore Admin Classic Bundle allows user enumeration Exploitation status Public exploit Fix Not confirmed Affected product A admin-ui-classic-bundle Published 02/07/2025 Severity Medium CVE-2024-11956Pimcore customer-data-framework list sql injection Exploitation status Public exploit Fix Affected product C customer-data-framework Published 01/28/2025 Severity Medium CVE-2024-11954Pimcore Search Document cross site scripting Exploitation status Public exploit Fix Not confirmed Affected product P Pimcore Published 01/28/2025 Severity Medium CVE-2023-2332Stored Cross-site Scripting (XSS) in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 11/15/2024 Severity Medium CVE-2024-49370Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing Exploitation status Public exploit Fix Not confirmed Affected product P pimcore Published 10/23/2024 Severity High CVE-2024-41109Pimcore vulnerable to disclosure of system and database information behind /admin firewall Exploitation status Public exploit Fix Affected product A admin-ui-classic-bundle Published 07/30/2024 Severity Medium CVE-2024-32871Pimcore Vulnerable to Flooding Server with Thumbnail files Exploitation status Not known exploited Fix Affected product P pimcore Published 06/04/2024 Severity High CVE-2024-29197Pimcore Preview Documents are not restricted to logged in users anymore Exploitation status Public exploit Fix Affected product P pimcore Published 03/26/2024 Severity Medium CVE-2024-25625Pimcore Host Header Injection in user invitation link Exploitation status Public exploit Fix Not confirmed Affected product A admin-ui-classic-bundle Published 02/19/2024 Severity High CVE-2024-24822Pimcore Admin Classic Bundle permissions are not getting checked when working with tags Exploitation status Not known exploited Fix Affected product A admin-ui-classic-bundle Published 02/07/2024 Severity Medium CVE-2024-23646Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip Exploitation status Public exploit Fix Not confirmed Affected product A admin-ui-classic-bundle Published 01/24/2024 Severity High CVE-2024-23648Pimcore Admin Classic Bundle host header injection in the password reset Exploitation status Public exploit Fix Not confirmed Affected product A admin-ui-classic-bundle Published 01/24/2024 Severity High CVE-2024-21667Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts Exploitation status Public exploit Fix Affected product C customer-data-framework Published 01/11/2024 Severity Medium CVE-2024-21666Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list Exploitation status Public exploit Fix Affected product C customer-data-framework Published 01/11/2024 Severity Medium CVE-2024-21665Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list Exploitation status Not known exploited Fix Affected product E ecommerce-framework-bundle Published 01/11/2024 Severity Medium CVE-2023-49076Pimcore missing token/header to prevent CSRF Exploitation status Public exploit Fix Affected product C customer-data-framework Published 11/30/2023 Severity Medium CVE-2023-49075Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls Exploitation status Not confirmed Fix Affected product A admin-ui-classic-bundle Published 11/28/2023 Severity High CVE-2023-47636Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle Exploitation status Public exploit Fix Affected product A admin-ui-classic-bundle Published 11/15/2023 Severity Medium CVE-2023-47637SQL Injection in Admin Grid Filter API in Pimcore Exploitation status Public exploit Fix Not confirmed Affected product P pimcore Published 11/15/2023 Severity High CVE-2023-46722Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews Exploitation status Not known exploited Fix Not confirmed Affected product A admin-ui-classic-bundle Published 10/31/2023 Severity Medium CVE-2023-5873Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 10/31/2023 Severity Medium CVE-2023-5844Unverified Password Change in pimcore/admin-ui-classic-bundle Exploitation status Public exploit Fix Affected product P pimcore/admin-ui-classic-bundle Published 10/30/2023 Severity Medium CVE-2023-5192Excessive Data Query Operations in a Large Data Table in pimcore/demo Exploitation status Public exploit Fix Affected product P pimcore/demo Published 09/26/2023 Severity Medium CVE-2023-42817Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations Exploitation status Not known exploited Fix Affected product A admin-ui-classic-bundle Published 09/25/2023 Severity Medium CVE-2023-4453Cross-site Scripting (XSS) - Reflected in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 08/21/2023 Severity Medium CVE-2023-38708Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 08/04/2023 Severity Medium CVE-2023-4145Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework Exploitation status Public exploit Fix Affected product P pimcore/customer-data-framework Published 08/03/2023 Severity Medium CVE-2023-3822Cross-site Scripting (XSS) - Reflected in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 07/21/2023 Severity Medium CVE-2023-3821Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 07/21/2023 Severity Medium CVE-2023-3820SQL Injection in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 07/21/2023 Severity High CVE-2023-3819Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 07/21/2023 Severity High CVE-2023-3673SQL Injection in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 07/14/2023 Severity High CVE-2023-37280Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page Exploitation status Not known exploited Fix Affected product A admin-ui-classic-bundle Published 07/11/2023 Severity Medium CVE-2023-3574Improper Authorization in pimcore/customer-data-framework Exploitation status Public exploit Fix Affected product P pimcore/customer-data-framework Published 07/10/2023 Severity Medium CVE-2023-2984Path Traversal: '\..\filename' in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 05/30/2023 Severity Medium CVE-2023-2983Privilege Defined With Unsafe Actions in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 05/30/2023 Severity Medium CVE-2023-2881Storing Passwords in a Recoverable Format in pimcore/customer-data-framework Exploitation status Not known exploited Fix Affected product P pimcore/customer-data-framework Published 05/25/2023 Severity Medium CVE-2023-2756SQL Injection in pimcore/customer-data-framework Exploitation status Public exploit Fix Affected product P pimcore/customer-data-framework Published 05/17/2023 Severity Medium CVE-2023-2730Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 05/16/2023 Severity Medium CVE-2023-32075Pimcore vulnerable to Business Logic Errors in Customer automation rules Exploitation status Public exploit Fix Not confirmed Affected product C customer-data-framework Published 05/11/2023 Severity Medium CVE-2023-2616Cross-site Scripting (XSS) - Generic in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 05/10/2023 Severity Medium CVE-2023-2630Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 05/10/2023 Severity Medium CVE-2023-2629Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework Exploitation status Public exploit Fix Affected product P pimcore/customer-data-framework Published 05/10/2023 Severity Medium CVE-2023-2614Cross-site Scripting (XSS) - DOM in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 05/10/2023 Severity Medium CVE-2023-2615Cross-site Scripting (XSS) - Reflected in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 05/10/2023 Severity Medium CVE-2023-30855Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 05/08/2023 Severity Medium CVE-2023-2361Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/28/2023 Severity Medium CVE-2023-30852Pimcore Arbitrary File Read in Admin JS CSS files Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 04/27/2023 Severity Medium CVE-2023-30850Pimcore SQL Injection Vulnerability in Admin Translations API Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 04/27/2023 Severity High CVE-2023-30849Pimcore vulnerable to SQL Injection in Translation Export API Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 04/27/2023 Severity High CVE-2023-30848Pimcore SQL Injection Vulnerability in Admin Search Find API Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 04/27/2023 Severity High CVE-2023-2341Cross-site Scripting (XSS) - Generic in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity High CVE-2023-2322Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity Medium CVE-2023-2338SQL Injection in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity High CVE-2023-2343Cross-site Scripting (XSS) - DOM in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity Medium CVE-2023-2340Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity Medium CVE-2023-2328Cross-site Scripting (XSS) - Generic in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity Medium CVE-2023-2336Path Traversal in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity Medium CVE-2023-2323Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity Medium CVE-2023-2327Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity Medium CVE-2023-2339Cross-site Scripting (XSS) - Reflected in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity Medium CVE-2023-2342Cross-site Scripting (XSS) - Reflected in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 04/27/2023 Severity Medium CVE-2023-28850Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name Exploitation status Not known exploited Fix Not confirmed Affected product P perspective-editor Published 04/03/2023 Severity Medium CVE-2023-1703Cross-site Scripting (XSS) - Generic in pimcore/pimcore Exploitation status Not known exploited Fix Affected product P pimcore/pimcore Published 03/29/2023 Severity Medium CVE-2023-1702Cross-site Scripting (XSS) - Generic in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 03/29/2023 Severity Medium CVE-2023-1704Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 03/29/2023 Severity Medium CVE-2023-1701Cross-site Scripting (XSS) - Reflected in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 03/29/2023 Severity Medium CVE-2023-28438Pimcore vulnerable to improper quoting of filters in Custom Reports Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 03/22/2023 Severity Medium CVE-2023-1578SQL Injection in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 03/22/2023 Severity Medium CVE-2023-28429Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 03/20/2023 Severity Medium CVE-2023-1517Cross-site Scripting (XSS) - DOM in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 03/20/2023 Severity Medium CVE-2023-1515Cross-site Scripting (XSS) - Stored in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 03/20/2023 Severity Medium CVE-2023-28108Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 03/16/2023 Severity High CVE-2023-28106Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type Exploitation status Not known exploited Fix Not confirmed Affected product P pimcore Published 03/16/2023 Severity Medium CVE-2023-1429Cross-site Scripting (XSS) - Reflected in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 03/16/2023 Severity Medium CVE-2023-1312Cross-site Scripting (XSS) - Reflected in pimcore/pimcore Exploitation status Public exploit Fix Affected product P pimcore/pimcore Published 03/10/2023 Severity Medium 
