Total 155 security vulnerabilities recorded for pimcore software and firmware.
Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6....
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7....
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command...
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
pimcore is vulnerable to Cross-Site Request Forgery (CSRF)...
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...
Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot pas...
Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custo...
Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the ...
Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The proble...
Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was fi...
Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAs...
This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectio...
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomRepo...
Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without havi...
The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreCon...
pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that...
Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messag...
Pimcore before 6.2.2 lacks brute force protection for the 2FA token....
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of th...
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification....