Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

pimcore — Vulnerabilities & Security Advisories 41

All 41 CVE vulnerabilities found in pimcore, with AI-generated Chinese analysis, references, and POCs.

This page serves as a comprehensive vulnerability aggregation resource for Pimcore, covering various weakness types and associated security tags. It collects detailed information on all known vulnerabilities affecting the Pimcore enterprise content management platform, ranging from initial disclosure dates through to recent updates, ensuring a complete historical overview of security issues within the software ecosystem. Visitors to this page can effectively track vendor advisories to stay informed about critical patches and mitigation strategies, gain a deeper understanding of specific weakness classes that impact Pimcore’s architecture and functionality, and look up the product’s comprehensive vulnerability history to assess long-term security posture and risk exposure. By centralizing these diverse data points, the resource facilitates easier analysis for security professionals, developers, and system administrators who rely on Pimcore for digital experience management and commerce solutions. The aggregated data is organized to highlight trends in vulnerability reports, allowing users to identify recurring issues or persistent weaknesses that may require immediate attention or strategic planning. This approach ensures that stakeholders have access to accurate, up-to-date information necessary for maintaining robust security practices and minimizing potential threats associated with the Pimcore platform.

Vendor: pimcore

CVE IDTitleCVSSSeverityPublished
CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter CWE-89 8.8 High2026-08-12
CVE-2026-45704 Pimcore: CustomReports Share Bypass CWE-862--2026-07-17
CVE-2026-44739 Pimcore: SQL Injection in Custom Reports Column Configuration CWE-89 8.7 High2026-07-17
CVE-2026-45260 Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling CWE-862 8.1 High2026-07-17
CVE-2026-45703 Pimcore: WordExport Authorization Bypass for Unauthorized Document Export CWE-862 6.4 Medium2026-07-17
CVE-2026-45162 Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction CWE-502 8.0 High2026-07-17
CVE-2026-55207 Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass CWE-640 8.8 High2026-07-09
CVE-2026-55208 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes CWE-89 7.7 High2026-07-09
CVE-2026-55212 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation CWE-285 7.1 High2026-07-09
CVE-2026-5362 Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering CWE-79 5.4AIMediumAI2026-04-27
CVE-2026-5394 Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling CWE-89 7.2AIHighAI2026-04-27
CVE-2026-27461 Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause CWE-89 4.9 -2026-02-24
CVE-2026-23496 Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization CWE-284 5.4 Medium2026-01-15
CVE-2026-23494 Pimcore is Missing Function Level Authorization on "Static Routes" Listing CWE-284 4.3 Medium2026-01-15
CVE-2026-23495 Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing CWE-284 4.3 Medium2026-01-15
CVE-2026-23493 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CWE-532 8.6 High2026-01-15
CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CWE-89 8.8 High2026-01-14
CVE-2025-27617 Pimcore Vulnerable to SQL Injection in getRelationFilterCondition CWE-89 8.8 -2025-03-11
CVE-2024-11954 Pimcore Search Document cross site scripting CWE-80 2.4 Low2025-01-28
CVE-2024-49370 Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing CWE-256 6.5AIMediumAI2024-10-23
CVE-2024-32871 Pimcore Vulnerable to Flooding Server with Thumbnail files CWE-770 7.5 High2024-06-04
CVE-2024-29197 Pimcore Preview Documents are not restricted to logged in users anymore CWE-200 6.5 Medium2024-03-26
CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore CWE-89 8.8 High2023-11-15
CVE-2023-38708 Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction CWE-22 6.3 Medium2023-08-04
CVE-2023-30855 Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php CWE-22 6.5 Medium2023-05-08
CVE-2023-30852 Pimcore Arbitrary File Read in Admin JS CSS files CWE-22 4.4 Medium2023-04-27
CVE-2023-30850 Pimcore SQL Injection Vulnerability in Admin Translations API CWE-89 8.8 High2023-04-27
CVE-2023-30849 Pimcore vulnerable to SQL Injection in Translation Export API CWE-89 8.8 High2023-04-27
CVE-2023-30848 Pimcore SQL Injection Vulnerability in Admin Search Find API CWE-89 8.8 High2023-04-27
CVE-2023-28438 Pimcore vulnerable to improper quoting of filters in Custom Reports CWE-89 6.2 Medium2023-03-22

All 41 known CVE vulnerabilities affecting pimcore with full Chinese analysis, references, and POCs where available.