Vendor CVEs
Pimcore
All CVEs
168 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-2323 | Med | 0.28 | 5.4 | 0.01 | Apr 27, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. | ||
| CVE-2023-2322 | Med | 0.28 | 5.4 | 0.01 | Apr 27, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. | ||
| CVE-2023-1704 | Med | 0.28 | 5.4 | 0.00 | Mar 29, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20. | ||
| CVE-2023-1703 | Med | 0.28 | 5.4 | 0.00 | Mar 29, 2023 | Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20. | ||
| CVE-2023-1702 | Med | 0.28 | 5.4 | 0.00 | Mar 29, 2023 | Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20. | ||
| CVE-2023-1701 | Med | 0.28 | 5.4 | 0.00 | Mar 29, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20. | ||
| CVE-2023-1515 | Med | 0.28 | 5.4 | 0.00 | Mar 20, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. | ||
| CVE-2023-1429 | Med | 0.28 | 5.4 | 0.00 | Mar 16, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. | ||
| CVE-2023-1117 | Med | 0.28 | 5.4 | 0.00 | Mar 1, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | ||
| CVE-2023-1116 | Med | 0.28 | 5.4 | 0.01 | Mar 1, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | ||
| CVE-2023-1115 | Med | 0.28 | 5.4 | 0.01 | Mar 1, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | ||
| CVE-2023-1067 | Med | 0.28 | 5.4 | 0.00 | Feb 27, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | ||
| CVE-2023-0827 | Med | 0.28 | 5.4 | 0.03 | Feb 14, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17. | ||
| CVE-2023-0323 | Med | 0.28 | 5.4 | 0.00 | Jan 16, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14. | ||
| CVE-2022-3211 | Med | 0.28 | 5.4 | 0.00 | Sep 15, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6. | ||
| CVE-2022-1351 | Med | 0.28 | 5.4 | 0.01 | Apr 14, 2022 | Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4. | ||
| CVE-2022-0705 | Med | 0.28 | 5.4 | 0.01 | Mar 16, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. | ||
| CVE-2022-0704 | Med | 0.28 | 5.4 | 0.01 | Mar 16, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. | ||
| CVE-2022-0911 | Med | 0.28 | 5.4 | 0.01 | Mar 16, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. | ||
| CVE-2022-0894 | Med | 0.28 | 5.4 | 0.01 | Mar 15, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. | ||
| CVE-2022-0893 | Med | 0.28 | 5.4 | 0.01 | Mar 15, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. | ||
| CVE-2022-0831 | Med | 0.28 | 5.4 | 0.01 | Mar 4, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. | ||
| CVE-2022-0510 | Med | 0.28 | 5.4 | 0.01 | Feb 8, 2022 | Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1. | ||
| CVE-2022-0509 | Med | 0.28 | 5.4 | 0.01 | Feb 8, 2022 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1. | ||
| CVE-2022-0348 | Med | 0.28 | 5.4 | 0.01 | Jan 27, 2022 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2. | ||
| CVE-2022-0251 | Med | 0.28 | 5.4 | 0.01 | Jan 26, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10. | ||
| CVE-2022-0285 | Med | 0.28 | 5.4 | 0.01 | Jan 20, 2022 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9. | ||
| CVE-2022-0260 | Med | 0.28 | 5.4 | 0.01 | Jan 18, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7. | ||
| CVE-2022-0257 | Med | 0.28 | 5.4 | 0.01 | Jan 17, 2022 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2022-0256 | Med | 0.28 | 5.4 | 0.01 | Jan 17, 2022 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ||
| CVE-2025-24980 | Med | 0.27 | 5.3 | 0.01 | Feb 7, 2025 | pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been… | ||
| CVE-2024-11956 | Med | 0.27 | 4.7 | 0.01 | Jan 28, 2025 | A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument… | ||
| CVE-2023-37280 | Med | 0.26 | 5.0 | 0.01 | Jul 11, 2023 | Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary… | ||
| CVE-2026-27461 | Med | 0.25 | 4.9 | 0.00 | Feb 24, 2026 | Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without… | ||
| CVE-2023-2881 | Med | 0.25 | 4.9 | 0.01 | May 25, 2023 | Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10. | ||
| CVE-2025-30166 | Med | 0.24 | 4.8 | 0.00 | Apr 8, 2025 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the… | ||
| CVE-2023-2332 | Med | 0.24 | 4.8 | 0.00 | Nov 15, 2024 | A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead… | ||
| CVE-2023-2630 | Med | 0.24 | 4.8 | 0.01 | May 10, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21. | ||
| CVE-2023-1517 | Med | 0.24 | 4.8 | 0.00 | Mar 20, 2023 | Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19. | ||
| CVE-2023-1312 | Med | 0.24 | 4.8 | 0.00 | Mar 10, 2023 | Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. | ||
| CVE-2023-1286 | Med | 0.24 | 4.8 | 0.00 | Mar 9, 2023 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. | ||
| CVE-2022-3255 | Med | 0.24 | 4.8 | 0.01 | Sep 21, 2022 | If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is… | ||
| CVE-2022-2796 | Med | 0.24 | 4.8 | 0.01 | Aug 23, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4. | ||
| CVE-2022-0955 | Med | 0.24 | 4.8 | 0.01 | Mar 24, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4. | ||
| CVE-2023-30852 | Med | 0.22 | 4.4 | 0.01 | Apr 27, 2023 | Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the `scriptPath` and… | ||
| CVE-2026-23495 | Med | 0.21 | 4.3 | 0.00 | Jan 15, 2026 | Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions… | ||
| CVE-2026-23494 | Med | 0.21 | 4.3 | 0.00 | Jan 15, 2026 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for reading or listing static routes. In Pimcore, static routes are custom URL… | ||
| CVE-2024-21665 | Med | 0.21 | 4.3 | 0.00 | Jan 11, 2024 | ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has… | ||
| CVE-2023-32075 | Med | 0.21 | 4.3 | 0.01 | May 11, 2023 | The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number.… | ||
| CVE-2021-4146 | Med | 0.21 | 4.3 | 0.01 | Jan 18, 2022 | Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6. |
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
- risk 0.28cvss 5.4epss 0.03
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.
- risk 0.28cvss 5.4epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6.
- risk 0.28cvss 5.4epss 0.01
Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
- risk 0.28cvss 5.4epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7.
- risk 0.28cvss 5.4epss 0.01
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.28cvss 5.4epss 0.01
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- risk 0.27cvss 5.3epss 0.01
pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been…
- risk 0.27cvss 4.7epss 0.01
A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument…
- risk 0.26cvss 5.0epss 0.01
Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary…
- risk 0.25cvss 4.9epss 0.00
Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without…
- risk 0.25cvss 4.9epss 0.01
Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.
- risk 0.24cvss 4.8epss 0.00
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the…
- risk 0.24cvss 4.8epss 0.00
A stored Cross-site Scripting (XSS) vulnerability exists in the Conditions tab of Pricing Rules in pimcore/pimcore versions 10.5.19. The vulnerability is present in the From and To fields of the Date Range section, allowing an attacker to inject malicious scripts. This can lead…
- risk 0.24cvss 4.8epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
- risk 0.24cvss 4.8epss 0.00
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
- risk 0.24cvss 4.8epss 0.01
If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is…
- risk 0.24cvss 4.8epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.
- risk 0.24cvss 4.8epss 0.01
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.
- risk 0.22cvss 4.4epss 0.01
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the `scriptPath` and…
- risk 0.21cvss 4.3epss 0.00
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions…
- risk 0.21cvss 4.3epss 0.00
Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for reading or listing static routes. In Pimcore, static routes are custom URL…
- risk 0.21cvss 4.3epss 0.00
ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned. Access control and permissions are not being enforced. This vulnerability has…
- risk 0.21cvss 4.3epss 0.01
The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management. In `pimcore/customer-management-framework-bundle` prior to version 3.3.9, business logic errors are possible in the `Conditions` tab since the counter can be a negative number.…
- risk 0.21cvss 4.3epss 0.01
Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6.
Page 3 of 4