# cve.now: Pimcore

The newest entries naming Pimcore as an affected vendor (up to 200), of 151 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109392](https://cve.now/CVE-2026-109392.md): Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview (CVSS 5.1)
- [CVE-2026-55416](https://cve.now/CVE-2026-55416.md): Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization (CVSS 8.8)
- [CVE-2026-55072](https://cve.now/CVE-2026-55072.md): Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name (CVSS 8.5)
- [CVE-2026-55634](https://cve.now/CVE-2026-55634.md): Pimcore: Remote Code Execution via DataObject Class-Definition Field Name (CVSS 9.9)
- [CVE-2026-55220](https://cve.now/CVE-2026-55220.md): Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (CVSS 9.3)
- [CVE-2026-44741](https://cve.now/CVE-2026-44741.md): Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter (CVSS 8.8)
- [CVE-2026-72562](https://cve.now/CVE-2026-72562.md): Pimcore pimcore admin-ui-classic-bundle - SQL Injection (CVSS 8.8)
- [CVE-2026-45704](https://cve.now/CVE-2026-45704.md): Pimcore: CustomReports Share Bypass (CVSS 7.1)
- [CVE-2026-44739](https://cve.now/CVE-2026-44739.md): Pimcore: SQL Injection in Custom Reports Column Configuration (CVSS 8.7)
- [CVE-2026-45260](https://cve.now/CVE-2026-45260.md): Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling (CVSS 8.1)
- [CVE-2026-45703](https://cve.now/CVE-2026-45703.md): Pimcore: WordExport Authorization Bypass for Unauthorized Document Export (CVSS 6.4)
- [CVE-2026-45162](https://cve.now/CVE-2026-45162.md): Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed\_classes Restriction (CVSS 8.0)
- [CVE-2026-55207](https://cve.now/CVE-2026-55207.md): Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass (CVSS 8.8)
- [CVE-2026-55208](https://cve.now/CVE-2026-55208.md): Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes (CVSS 7.7)
- [CVE-2026-55212](https://cve.now/CVE-2026-55212.md): Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation (CVSS 7.1)
- [CVE-2026-11407](https://cve.now/CVE-2026-11407.md): Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed (CVSS 8.6)
- [CVE-2026-5362](https://cve.now/CVE-2026-5362.md): Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering (CVSS 4.8)
- [CVE-2026-5394](https://cve.now/CVE-2026-5394.md): Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling (CVSS 7.0)
- [CVE-2026-27461](https://cve.now/CVE-2026-27461.md): Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause (CVSS 6.9)
- [CVE-2026-23496](https://cve.now/CVE-2026-23496.md): Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization (CVSS 5.4)
- [CVE-2026-23494](https://cve.now/CVE-2026-23494.md): Pimcore is Missing Function Level Authorization on "Static Routes" Listing (CVSS 4.3)
- [CVE-2026-23495](https://cve.now/CVE-2026-23495.md): Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing (CVSS 4.3)
- [CVE-2026-23493](https://cve.now/CVE-2026-23493.md): Pimcore ENV Variables and Cookie Informations are exposed in http\_error\_log (CVSS 8.6)
- [CVE-2026-23492](https://cve.now/CVE-2026-23492.md): Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 (CVSS 8.8)
- [CVE-2025-30166](https://cve.now/CVE-2025-30166.md): Pimcore's Admin Classic Bundle allows HTML Injection (CVSS 1.8)
- [CVE-2025-27617](https://cve.now/CVE-2025-27617.md): Pimcore Vulnerable to SQL Injection in getRelationFilterCondition (CVSS 6.3)
- [CVE-2025-24980](https://cve.now/CVE-2025-24980.md): Pimcore Admin Classic Bundle allows user enumeration (CVSS 6.9)
- [CVE-2024-11956](https://cve.now/CVE-2024-11956.md): Pimcore customer-data-framework list sql injection (CVSS 5.1)
- [CVE-2023-2332](https://cve.now/CVE-2023-2332.md): Stored Cross-site Scripting (XSS) in pimcore/pimcore (CVSS 4.0)
- [CVE-2024-49370](https://cve.now/CVE-2024-49370.md): Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing (CVSS 8.7)
- [CVE-2024-41109](https://cve.now/CVE-2024-41109.md): Pimcore vulnerable to disclosure of system and database information behind /admin firewall (CVSS 6.3)
- [CVE-2024-32871](https://cve.now/CVE-2024-32871.md): Pimcore Vulnerable to Flooding Server with Thumbnail files (CVSS 7.5)
- [CVE-2024-29197](https://cve.now/CVE-2024-29197.md): Pimcore Preview Documents are not restricted to logged in users anymore (CVSS 6.5)
- [CVE-2024-25625](https://cve.now/CVE-2024-25625.md): Pimcore Host Header Injection in user invitation link (CVSS 8.1)
- [CVE-2024-24822](https://cve.now/CVE-2024-24822.md): Pimcore Admin Classic Bundle permissions are not getting checked when working with tags (CVSS 6.5)
- [CVE-2024-23646](https://cve.now/CVE-2024-23646.md): Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip (CVSS 8.8)
- [CVE-2024-23648](https://cve.now/CVE-2024-23648.md): Pimcore Admin Classic Bundle host header injection in the password reset (CVSS 8.8)
- [CVE-2024-21667](https://cve.now/CVE-2024-21667.md): Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts (CVSS 6.5)
- [CVE-2024-21666](https://cve.now/CVE-2024-21666.md): Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list (CVSS 6.5)
- [CVE-2024-21665](https://cve.now/CVE-2024-21665.md): Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list (CVSS 4.3)
- [CVE-2023-49076](https://cve.now/CVE-2023-49076.md): Pimcore missing token/header to prevent CSRF (CVSS 4.3)
- [CVE-2023-49075](https://cve.now/CVE-2023-49075.md): Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls (CVSS 8.5)
- [CVE-2023-47636](https://cve.now/CVE-2023-47636.md): Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle (CVSS 5.3)
- [CVE-2023-47637](https://cve.now/CVE-2023-47637.md): SQL Injection in Admin Grid Filter API in Pimcore (CVSS 8.8)
- [CVE-2023-46722](https://cve.now/CVE-2023-46722.md): Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews (CVSS 6.1)
- [CVE-2023-5873](https://cve.now/CVE-2023-5873.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.0)
- [CVE-2023-5844](https://cve.now/CVE-2023-5844.md): Unverified Password Change in pimcore/admin-ui-classic-bundle (CVSS 4.3)
- [CVE-2023-5192](https://cve.now/CVE-2023-5192.md): Excessive Data Query Operations in a Large Data Table in pimcore/demo (CVSS 6.1)
- [CVE-2023-42817](https://cve.now/CVE-2023-42817.md): Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations (CVSS 5.4)
- [CVE-2023-4453](https://cve.now/CVE-2023-4453.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 6.4)
- [CVE-2023-38708](https://cve.now/CVE-2023-38708.md): Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction (CVSS 6.3)
- [CVE-2023-4145](https://cve.now/CVE-2023-4145.md): Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework (CVSS 6.5)
- [CVE-2023-3822](https://cve.now/CVE-2023-3822.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 6.0)
- [CVE-2023-3821](https://cve.now/CVE-2023-3821.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.1)
- [CVE-2023-3820](https://cve.now/CVE-2023-3820.md): SQL Injection in pimcore/pimcore (CVSS 7.2)
- [CVE-2023-3819](https://cve.now/CVE-2023-3819.md): Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore (CVSS 7.6)
- [CVE-2023-3673](https://cve.now/CVE-2023-3673.md): SQL Injection in pimcore/pimcore (CVSS 7.2)
- [CVE-2023-37280](https://cve.now/CVE-2023-37280.md): Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page (CVSS 5.0)
- [CVE-2023-3574](https://cve.now/CVE-2023-3574.md): Improper Authorization in pimcore/customer-data-framework (CVSS 6.3)
- [CVE-2023-2984](https://cve.now/CVE-2023-2984.md): Path Traversal: '\\..\\filename' in pimcore/pimcore (CVSS 6.3)
- [CVE-2023-2983](https://cve.now/CVE-2023-2983.md): Privilege Defined With Unsafe Actions in pimcore/pimcore (CVSS 6.5)
- [CVE-2023-2881](https://cve.now/CVE-2023-2881.md): Storing Passwords in a Recoverable Format in pimcore/customer-data-framework (CVSS 6.7)
- [CVE-2023-2756](https://cve.now/CVE-2023-2756.md): SQL Injection in pimcore/customer-data-framework (CVSS 6.5)
- [CVE-2023-2730](https://cve.now/CVE-2023-2730.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.3)
- [CVE-2023-32075](https://cve.now/CVE-2023-32075.md): Pimcore vulnerable to Business Logic Errors in Customer automation rules (CVSS 4.3)
- [CVE-2023-2630](https://cve.now/CVE-2023-2630.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.7)
- [CVE-2023-2629](https://cve.now/CVE-2023-2629.md): Improper Neutralization of Formula Elements in a CSV File in pimcore/customer-data-framework (CVSS 5.0)
- [CVE-2023-2616](https://cve.now/CVE-2023-2616.md): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (CVSS 6.8)
- [CVE-2023-2615](https://cve.now/CVE-2023-2615.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 6.8)
- [CVE-2023-2614](https://cve.now/CVE-2023-2614.md): Cross-site Scripting (XSS) - DOM in pimcore/pimcore (CVSS 6.8)
- [CVE-2023-30855](https://cve.now/CVE-2023-30855.md): Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php (CVSS 6.5)
- [CVE-2023-2361](https://cve.now/CVE-2023-2361.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.3)
- [CVE-2023-30852](https://cve.now/CVE-2023-30852.md): Pimcore Arbitrary File Read in Admin JS CSS files (CVSS 4.4)
- [CVE-2023-30850](https://cve.now/CVE-2023-30850.md): Pimcore SQL Injection Vulnerability in Admin Translations API (CVSS 8.8)
- [CVE-2023-30849](https://cve.now/CVE-2023-30849.md): Pimcore vulnerable to SQL Injection in Translation Export API (CVSS 8.8)
- [CVE-2023-30848](https://cve.now/CVE-2023-30848.md): Pimcore SQL Injection Vulnerability in Admin Search Find API (CVSS 8.8)
- [CVE-2023-2343](https://cve.now/CVE-2023-2343.md): Cross-site Scripting (XSS) - DOM in pimcore/pimcore (CVSS 5.2)
- [CVE-2023-2342](https://cve.now/CVE-2023-2342.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 4.0)
- [CVE-2023-2341](https://cve.now/CVE-2023-2341.md): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (CVSS 7.3)
- [CVE-2023-2340](https://cve.now/CVE-2023-2340.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.1)
- [CVE-2023-2339](https://cve.now/CVE-2023-2339.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 6.1)
- [CVE-2023-2338](https://cve.now/CVE-2023-2338.md): SQL Injection in pimcore/pimcore (CVSS 7.2)
- [CVE-2023-2336](https://cve.now/CVE-2023-2336.md): Path Traversal in pimcore/pimcore (CVSS 5.5)
- [CVE-2023-2328](https://cve.now/CVE-2023-2328.md): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (CVSS 5.2)
- [CVE-2023-2327](https://cve.now/CVE-2023-2327.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.0)
- [CVE-2023-2323](https://cve.now/CVE-2023-2323.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.8)
- [CVE-2023-2322](https://cve.now/CVE-2023-2322.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.2)
- [CVE-2023-28850](https://cve.now/CVE-2023-28850.md): Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name (CVSS 6.1)
- [CVE-2023-1704](https://cve.now/CVE-2023-1704.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.1)
- [CVE-2023-1703](https://cve.now/CVE-2023-1703.md): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (CVSS 5.3)
- [CVE-2023-1702](https://cve.now/CVE-2023-1702.md): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (CVSS 4.0)
- [CVE-2023-1701](https://cve.now/CVE-2023-1701.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 4.0)
- [CVE-2023-28438](https://cve.now/CVE-2023-28438.md): Pimcore vulnerable to improper quoting of filters in Custom Reports (CVSS 6.2)
- [CVE-2023-1578](https://cve.now/CVE-2023-1578.md): SQL Injection in pimcore/pimcore (CVSS 6.7)
- [CVE-2023-28429](https://cve.now/CVE-2023-28429.md): Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field (CVSS 6.1)
- [CVE-2023-1517](https://cve.now/CVE-2023-1517.md): Cross-site Scripting (XSS) - DOM in pimcore/pimcore (CVSS 4.0)
- [CVE-2023-1515](https://cve.now/CVE-2023-1515.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.2)
- [CVE-2023-28108](https://cve.now/CVE-2023-28108.md): Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model (CVSS 7.9)
- [CVE-2023-28106](https://cve.now/CVE-2023-28106.md): Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type (CVSS 6.1)
- [CVE-2023-1429](https://cve.now/CVE-2023-1429.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 4.0)
- [CVE-2023-1312](https://cve.now/CVE-2023-1312.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 5.2)
- [CVE-2023-1286](https://cve.now/CVE-2023-1286.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.8)
- [CVE-2023-1117](https://cve.now/CVE-2023-1117.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.8)
- [CVE-2023-1116](https://cve.now/CVE-2023-1116.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.4)
- [CVE-2023-1115](https://cve.now/CVE-2023-1115.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 7.6)
- [CVE-2023-1067](https://cve.now/CVE-2023-1067.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.2)
- [CVE-2023-0827](https://cve.now/CVE-2023-0827.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.3)
- [CVE-2023-23937](https://cve.now/CVE-2023-23937.md): Missing file upload type validation in pimcore/pimcore (CVSS 8.2)
- [CVE-2023-0323](https://cve.now/CVE-2023-0323.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.1)
- [CVE-2022-39365](https://cve.now/CVE-2022-39365.md): RCE vulnerability in Pimcore/Mail & Dynamic Text Layout (CVSS 9.8)
- [CVE-2022-3255](https://cve.now/CVE-2022-3255.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 6.8)
- [CVE-2022-3211](https://cve.now/CVE-2022-3211.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.8)
- [CVE-2022-2796](https://cve.now/CVE-2022-2796.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.7)
- [CVE-2022-31092](https://cve.now/CVE-2022-31092.md): SQL injection in pimcore (CVSS 7.5)
- [CVE-2022-1429](https://cve.now/CVE-2022-1429.md): SQL injection in GridHelperService.php in pimcore/pimcore (CVSS 7.2)
- [CVE-2022-1351](https://cve.now/CVE-2022-1351.md): Stored XSS in Tooltip in pimcore/pimcore (CVSS 6.8)
- [CVE-2022-1339](https://cve.now/CVE-2022-1339.md): SQL injection in ElementController.php in pimcore/pimcore (CVSS 8.8)
- [CVE-2022-1219](https://cve.now/CVE-2022-1219.md): SQL injection in RecyclebinController.php in pimcore/pimcore (CVSS 7.2)
- [CVE-2022-0955](https://cve.now/CVE-2022-0955.md): Cross-site Scripting (XSS) - Stored in pimcore/data-hub (CVSS 6.5)
- [CVE-2022-0705](https://cve.now/CVE-2022-0705.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.2)
- [CVE-2022-0704](https://cve.now/CVE-2022-0704.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.0)
- [CVE-2022-0911](https://cve.now/CVE-2022-0911.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.8)
- [CVE-2022-0893](https://cve.now/CVE-2022-0893.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.8)
- [CVE-2022-0894](https://cve.now/CVE-2022-0894.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 8.2)
- [CVE-2022-0832](https://cve.now/CVE-2022-0832.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.6)
- [CVE-2022-0831](https://cve.now/CVE-2022-0831.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.6)
- [CVE-2022-0665](https://cve.now/CVE-2022-0665.md): Path Traversal in pimcore/pimcore (CVSS 4.9)
- [CVE-2022-0565](https://cve.now/CVE-2022-0565.md): Cross-site Scripting in pimcore/pimcore (CVSS 7.6)
- [CVE-2022-0510](https://cve.now/CVE-2022-0510.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 4.3)
- [CVE-2022-0509](https://cve.now/CVE-2022-0509.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.6)
- [CVE-2022-0348](https://cve.now/CVE-2022-0348.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.3)
- [CVE-2022-0251](https://cve.now/CVE-2022-0251.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 8.1)
- [CVE-2022-0285](https://cve.now/CVE-2022-0285.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.6)
- [CVE-2022-0263](https://cve.now/CVE-2022-0263.md): Unrestricted Upload of File with Dangerous Type in pimcore/pimcore (CVSS 6.6)
- [CVE-2022-0262](https://cve.now/CVE-2022-0262.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.6)
- [CVE-2021-4146](https://cve.now/CVE-2021-4146.md): Business Logic Errors in pimcore/pimcore (CVSS 4.3)
- [CVE-2022-0260](https://cve.now/CVE-2022-0260.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.5)
- [CVE-2022-0257](https://cve.now/CVE-2022-0257.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.1)
- [CVE-2022-0258](https://cve.now/CVE-2022-0258.md): SQL Injection in pimcore/pimcore (CVSS 8.3)
- [CVE-2022-0256](https://cve.now/CVE-2022-0256.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.3)
- [CVE-2021-4139](https://cve.now/CVE-2021-4139.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.6)
- [CVE-2021-4084](https://cve.now/CVE-2021-4084.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 7.4)
- [CVE-2021-4081](https://cve.now/CVE-2021-4081.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 5.5)
- [CVE-2021-4082](https://cve.now/CVE-2021-4082.md): Cross-Site Request Forgery (CSRF) in pimcore/pimcore (CVSS 4.3)
- [CVE-2021-39189](https://cve.now/CVE-2021-39189.md): Observable Response Discrepancy in Lost Password Service (CVSS 5.3)
- [CVE-2021-39170](https://cve.now/CVE-2021-39170.md): Improper Encoding or Escaping of Output in Asset Metadata Component (CVSS 8.0)
- [CVE-2021-39166](https://cve.now/CVE-2021-39166.md): Improper Neutralization of Text-Values in Object Version Preview (CVSS 8.0)
- [CVE-2021-37702](https://cve.now/CVE-2021-37702.md): Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore (CVSS 8.0)
- [CVE-2021-31869](https://cve.now/CVE-2021-31869.md): Pimcore AdminBundle 'specificID' SQL Injection (CVSS 6.5)
- [CVE-2021-31867](https://cve.now/CVE-2021-31867.md): Pimcore Customer Data Framework 'SegmentAssignmentController.php' Blind SQL Injection (CVSS 6.5)
- [CVE-2020-26246](https://cve.now/CVE-2020-26246.md): Authorization bypass in Pimcore (CVSS 7.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pimcore
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.