Pimcore vulnerabilities
151 CVEs and advisories name Pimcore as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-109392Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
- CVE-2026-55416Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization
- CVE-2026-55072Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
- CVE-2026-55634Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
- CVE-2026-55220Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column
- CVE-2026-44741Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
- CVE-2026-72562Pimcore pimcore admin-ui-classic-bundle - SQL Injection
- CVE-2026-45704Pimcore: CustomReports Share Bypass
- CVE-2026-44739Pimcore: SQL Injection in Custom Reports Column Configuration
- CVE-2026-45260Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
- CVE-2026-45703Pimcore: WordExport Authorization Bypass for Unauthorized Document Export
- CVE-2026-45162Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
- CVE-2026-55207Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
- CVE-2026-55208Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
- CVE-2026-55212Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
- CVE-2026-11407Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
- CVE-2026-5362Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering
- CVE-2026-5394Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling
- CVE-2026-27461Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
- CVE-2026-23496Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
- CVE-2026-23494Pimcore is Missing Function Level Authorization on "Static Routes" Listing
- CVE-2026-23495Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing
- CVE-2026-23493Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
- CVE-2026-23492Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848
- CVE-2025-30166Pimcore's Admin Classic Bundle allows HTML Injection
- CVE-2025-27617Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
- CVE-2025-24980Pimcore Admin Classic Bundle allows user enumeration
- CVE-2024-11956Pimcore customer-data-framework list sql injection
- CVE-2023-2332Stored Cross-site Scripting (XSS) in pimcore/pimcore
- CVE-2024-49370Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing