Pimcore vulnerabilities
151 CVEs and advisories name Pimcore as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-41109Pimcore vulnerable to disclosure of system and database information behind /admin firewall
- CVE-2024-32871Pimcore Vulnerable to Flooding Server with Thumbnail files
- CVE-2024-29197Pimcore Preview Documents are not restricted to logged in users anymore
- CVE-2024-25625Pimcore Host Header Injection in user invitation link
- CVE-2024-24822Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
- CVE-2024-23646Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
- CVE-2024-23648Pimcore Admin Classic Bundle host header injection in the password reset
- CVE-2024-21667Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts
- CVE-2024-21666Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list
- CVE-2024-21665Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list
- CVE-2023-49076Pimcore missing token/header to prevent CSRF
- CVE-2023-49075Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
- CVE-2023-47636Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle
- CVE-2023-47637SQL Injection in Admin Grid Filter API in Pimcore
- CVE-2023-46722Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews
- CVE-2023-5873Cross-site Scripting (XSS) - Stored in pimcore/pimcore
- CVE-2023-5844Unverified Password Change in pimcore/admin-ui-classic-bundle
- CVE-2023-5192Excessive Data Query Operations in a Large Data Table in pimcore/demo
- CVE-2023-42817Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations
- CVE-2023-4453Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
- CVE-2023-38708Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction
- CVE-2023-4145Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework
- CVE-2023-3822Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
- CVE-2023-3821Cross-site Scripting (XSS) - Stored in pimcore/pimcore
- CVE-2023-3820SQL Injection in pimcore/pimcore
- CVE-2023-3819Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore
- CVE-2023-3673SQL Injection in pimcore/pimcore
- CVE-2023-37280Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page
- CVE-2023-3574Improper Authorization in pimcore/customer-data-framework
- CVE-2023-2984Path Traversal: '\..\filename' in pimcore/pimcore