Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

pimcore — Vulnerabilities & Security Advisories 45

All 45 CVE vulnerabilities found in pimcore, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities specifically affecting Pimcore, a PHP-based product, focusing on known weakness types such as SQL injection and cross-site scripting. It collects documented defects reported within the last five years, providing a consolidated view of security issues identified in releases of this content management system. Visitors can use this resource to track the vendor’s advisory history, understand specific vulnerability classes, and review the cumulative security posture of Pimcore over time.

Vendor: pimcore

CVE ID Title CVSS Severity Published
CVE-2026-55416 Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization CWE-89 8.8 High 2026-09-14
CVE-2026-55072 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name CWE-20 8.5 High 2026-09-14
CVE-2026-55634 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name CWE-89 9.9 Critical 2026-08-28
CVE-2026-55220 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column CWE-502 9.3 Critical 2026-08-28
CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter CWE-89 8.8 High 2026-08-12
CVE-2026-45704 Pimcore: CustomReports Share Bypass CWE-862 - - 2026-07-17
CVE-2026-44739 Pimcore: SQL Injection in Custom Reports Column Configuration CWE-89 8.7 High 2026-07-17
CVE-2026-45260 Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling CWE-862 8.1 High 2026-07-17
CVE-2026-45703 Pimcore: WordExport Authorization Bypass for Unauthorized Document Export CWE-862 6.4 Medium 2026-07-17
CVE-2026-45162 Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction CWE-502 8.0 High 2026-07-17
CVE-2026-55207 Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass CWE-640 8.8 High 2026-07-09
CVE-2026-55208 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes CWE-89 7.7 High 2026-07-09
CVE-2026-55212 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation CWE-285 7.1 High 2026-07-09
CVE-2026-5362 Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering CWE-79 5.4AI Medium AI 2026-04-27
CVE-2026-5394 Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling CWE-89 7.2AI High AI 2026-04-27
CVE-2026-27461 Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause CWE-89 4.9 - 2026-02-24
CVE-2026-23496 Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization CWE-284 5.4 Medium 2026-01-15
CVE-2026-23494 Pimcore is Missing Function Level Authorization on "Static Routes" Listing CWE-284 4.3 Medium 2026-01-15
CVE-2026-23495 Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing CWE-284 4.3 Medium 2026-01-15
CVE-2026-23493 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CWE-532 8.6 High 2026-01-15
CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CWE-89 8.8 High 2026-01-14
CVE-2025-27617 Pimcore Vulnerable to SQL Injection in getRelationFilterCondition CWE-89 8.8 - 2025-03-11
CVE-2024-11954 Pimcore Search Document cross site scripting CWE-80 2.4 Low 2025-01-28
CVE-2024-49370 Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing CWE-256 6.5AI Medium AI 2024-10-23
CVE-2024-32871 Pimcore Vulnerable to Flooding Server with Thumbnail files CWE-770 7.5 High 2024-06-04
CVE-2024-29197 Pimcore Preview Documents are not restricted to logged in users anymore CWE-200 6.5 Medium 2024-03-26
CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore CWE-89 8.8 High 2023-11-15
CVE-2023-38708 Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction CWE-22 6.3 Medium 2023-08-04
CVE-2023-30855 Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php CWE-22 6.5 Medium 2023-05-08
CVE-2023-30852 Pimcore Arbitrary File Read in Admin JS CSS files CWE-22 4.4 Medium 2023-04-27

All 45 known CVE vulnerabilities affecting pimcore with full Chinese analysis, references, and POCs where available.