pimcore

Top products

The 15 most recently published vulnerabilities affecting pimcore.

• CVE-2026-55634Pimcore: Remote Code Execution via DataObject Class-Definition Field Name9.9Aug 28, 2026
• CVE-2026-44741Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter8.8Aug 12, 2026
• CVE-2026-72562Pimcore pimcore admin-ui-classic-bundle - SQL Injection8.8Aug 11, 2026
• CVE-2026-44739Pimcore: SQL Injection in Custom Reports Column Configuration8.7Jul 17, 2026
• CVE-2026-45260Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling8.1Jul 17, 2026
• CVE-2026-45703Pimcore: WordExport Authorization Bypass for Unauthorized Document Export6.4Jul 17, 2026
• CVE-2026-45162Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction8.0Jul 17, 2026
• CVE-2026-55207Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass8.8Jul 9, 2026
• CVE-2026-55208Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes7.7Jul 9, 2026
• CVE-2026-55212Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation7.1Jul 9, 2026
• CVE-2026-5362Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering5.4Apr 27, 2026
• CVE-2026-27461Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause4.9Feb 24, 2026
• CVE-2026-23496Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization5.4Jan 15, 2026
• CVE-2026-23494Pimcore is Missing Function Level Authorization on "Static Routes" Listing4.3Jan 15, 2026
• CVE-2026-23495Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing4.3Jan 15, 2026