Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/pimcore/pimcore@10.5.18
Typecomposer
Namespacepimcore
Namepimcore
Version10.5.18
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version12.3.4
Latest_non_vulnerable_version12.3.7
Affected_by_vulnerabilities
0
url VCID-13m1-u59p-eue5
vulnerability_id VCID-13m1-u59p-eue5
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1517
reference_id
reference_type
scores
0
value 0.00015
scoring_system epss
scoring_elements 0.03578
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1517
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/3a22700dacd8a439cffcb208838a4199e732cff7
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-26T19:22:48Z/
url https://github.com/pimcore/pimcore/commit/3a22700dacd8a439cffcb208838a4199e732cff7
3
reference_url https://github.com/pimcore/pimcore/pull/14631
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14631
4
reference_url https://github.com/pimcore/pimcore/pull/14631.patch
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14631.patch
5
reference_url https://huntr.dev/bounties/82adf0dd-8ebd-4d15-9f91-6060c8fa5a0d
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-26T19:22:48Z/
url https://huntr.dev/bounties/82adf0dd-8ebd-4d15-9f91-6060c8fa5a0d
6
reference_url https://huntr.dev/bounties/82adf0dd-8ebd-4d15-9f91-6060c8fa5a0d/
reference_id
reference_type
scores
url https://huntr.dev/bounties/82adf0dd-8ebd-4d15-9f91-6060c8fa5a0d/
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1517
reference_id CVE-2023-1517
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1517
8
reference_url https://github.com/advisories/GHSA-42x8-2v53-pqmj
reference_id GHSA-42x8-2v53-pqmj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-42x8-2v53-pqmj
9
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-42x8-2v53-pqmj
reference_id GHSA-42x8-2v53-pqmj
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-42x8-2v53-pqmj
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
aliases CVE-2023-1517, GHSA-42x8-2v53-pqmj
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-13m1-u59p-eue5
1
url VCID-1hqj-r197-dyfe
vulnerability_id VCID-1hqj-r197-dyfe
summary Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2983
reference_id
reference_type
scores
0
value 9e-05
scoring_system epss
scoring_elements 0.00992
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2983
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-10T20:52:11Z/
url https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a
3
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-m4mv-rmr7-h5f5
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-m4mv-rmr7-h5f5
4
reference_url https://huntr.dev/bounties/6b2f33d3-2fd0-4d2d-ad7b-2c1e2417eeb1
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-01-10T20:52:11Z/
url https://huntr.dev/bounties/6b2f33d3-2fd0-4d2d-ad7b-2c1e2417eeb1
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2983
reference_id CVE-2023-2983
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2983
6
reference_url https://github.com/advisories/GHSA-m4mv-rmr7-h5f5
reference_id GHSA-m4mv-rmr7-h5f5
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-m4mv-rmr7-h5f5
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.23
purl pkg:composer/pimcore/pimcore@10.5.23
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-bb65-xxsn-m3gv
2
vulnerability VCID-cbx2-f95n-kqgd
3
vulnerability VCID-de3u-8wqt-uyc2
4
vulnerability VCID-dhdb-wakw-pufe
5
vulnerability VCID-f4vw-12f3-wfgb
6
vulnerability VCID-f5cg-bkw2-hqct
7
vulnerability VCID-hed9-c39j-87g2
8
vulnerability VCID-mcrd-q5wz-d7dk
9
vulnerability VCID-q7xb-xff7-77cf
10
vulnerability VCID-uaf3-v6zj-uuc3
11
vulnerability VCID-wzbf-bazj-4kgy
12
vulnerability VCID-xfwh-3838-j7ct
13
vulnerability VCID-xgwg-8q8s-cbfk
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.23
aliases CVE-2023-2983, GHSA-m4mv-rmr7-h5f5
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-1hqj-r197-dyfe
2
url VCID-354d-zv99-73g6
vulnerability_id VCID-354d-zv99-73g6
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1312
reference_id
reference_type
scores
0
value 0.00035
scoring_system epss
scoring_elements 0.10843
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1312
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/d35d0712858f24d0ec96ddfd4cbe82ff4b5a5fbb
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-28T15:36:24Z/
url https://github.com/pimcore/pimcore/commit/d35d0712858f24d0ec96ddfd4cbe82ff4b5a5fbb
3
reference_url https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-28T15:36:24Z/
url https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1312
reference_id CVE-2023-1312
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1312
5
reference_url https://github.com/advisories/GHSA-gh4g-65f6-84g5
reference_id GHSA-gh4g-65f6-84g5
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-gh4g-65f6-84g5
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-1312, GHSA-gh4g-65f6-84g5
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-354d-zv99-73g6
3
url VCID-3et6-gmgj-h7bn
vulnerability_id VCID-3et6-gmgj-h7bn
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2327
reference_id
reference_type
scores
0
value 0.00017
scoring_system epss
scoring_elements 0.04721
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2327
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/fb3056a21d439135480ee299bf1ab646867b5f4f
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:33:19Z/
url https://github.com/pimcore/pimcore/commit/fb3056a21d439135480ee299bf1ab646867b5f4f
3
reference_url https://huntr.dev/bounties/7336b71f-a36f-4ce7-a26d-c8335ac713d6
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:33:19Z/
url https://huntr.dev/bounties/7336b71f-a36f-4ce7-a26d-c8335ac713d6
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2327
reference_id CVE-2023-2327
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2327
5
reference_url https://github.com/advisories/GHSA-x9xj-pqmv-8jf7
reference_id GHSA-x9xj-pqmv-8jf7
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-x9xj-pqmv-8jf7
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-x9xj-pqmv-8jf7
reference_id GHSA-x9xj-pqmv-8jf7
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-x9xj-pqmv-8jf7
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2327, GHSA-x9xj-pqmv-8jf7
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3et6-gmgj-h7bn
4
url VCID-3ref-crmy-eucd
vulnerability_id VCID-3ref-crmy-eucd
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1702
reference_id
reference_type
scores
0
value 0.00014
scoring_system epss
scoring_elements 0.02783
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1702
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/2b997737dd6a60be2239a51dd6d9ef5881568e6d
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T16:51:36Z/
url https://github.com/pimcore/pimcore/commit/2b997737dd6a60be2239a51dd6d9ef5881568e6d
3
reference_url https://github.com/pimcore/pimcore/pull/14721.patch
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14721.patch
4
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-6qjm-39vh-729w
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-6qjm-39vh-729w
5
reference_url https://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T16:51:36Z/
url https://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1702
reference_id CVE-2023-1702
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1702
7
reference_url https://github.com/advisories/GHSA-69fc-v223-6rjw
reference_id GHSA-69fc-v223-6rjw
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-69fc-v223-6rjw
8
reference_url https://github.com/advisories/GHSA-6qjm-39vh-729w
reference_id GHSA-6qjm-39vh-729w
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6qjm-39vh-729w
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.20
purl pkg:composer/pimcore/pimcore@10.5.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-4dk6-cfer-t7b5
3
vulnerability VCID-5qj5-vh6d-7khq
4
vulnerability VCID-5tz5-h4wq-3qfy
5
vulnerability VCID-68hd-e927-4kcu
6
vulnerability VCID-6w41-7cfk-j7cn
7
vulnerability VCID-979q-g8dh-1fgw
8
vulnerability VCID-9ra4-dac9-7qba
9
vulnerability VCID-bb65-xxsn-m3gv
10
vulnerability VCID-c2j7-ywhr-3ff3
11
vulnerability VCID-c5af-wpgt-dkep
12
vulnerability VCID-cbx2-f95n-kqgd
13
vulnerability VCID-de3u-8wqt-uyc2
14
vulnerability VCID-dhdb-wakw-pufe
15
vulnerability VCID-drty-cbue-3kcv
16
vulnerability VCID-e11t-ywn5-v7gp
17
vulnerability VCID-f4vw-12f3-wfgb
18
vulnerability VCID-f5cg-bkw2-hqct
19
vulnerability VCID-hed9-c39j-87g2
20
vulnerability VCID-jgxx-v2wj-zkfh
21
vulnerability VCID-jxr2-qjbz-17ha
22
vulnerability VCID-m9aa-5k15-dfap
23
vulnerability VCID-mapb-drtt-rbez
24
vulnerability VCID-mcrd-q5wz-d7dk
25
vulnerability VCID-mwu6-2hxd-efc2
26
vulnerability VCID-n6h3-gsty-sua2
27
vulnerability VCID-q7xb-xff7-77cf
28
vulnerability VCID-uaf3-v6zj-uuc3
29
vulnerability VCID-uxdh-6r6k-h7fr
30
vulnerability VCID-v6d4-h4sz-4yad
31
vulnerability VCID-wzbf-bazj-4kgy
32
vulnerability VCID-xfwh-3838-j7ct
33
vulnerability VCID-xgwg-8q8s-cbfk
34
vulnerability VCID-y92e-mb7u-sueg
35
vulnerability VCID-zbp5-8ec3-gfe4
36
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.20
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-1702, GHSA-69fc-v223-6rjw, GHSA-6qjm-39vh-729w
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3ref-crmy-eucd
5
url VCID-4dk6-cfer-t7b5
vulnerability_id VCID-4dk6-cfer-t7b5
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2614
reference_id
reference_type
scores
0
value 0.00011
scoring_system epss
scoring_elements 0.01364
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2614
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-27T19:42:03Z/
url https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7
3
reference_url https://huntr.dev/bounties/1a5e6c65-2c5e-4617-9411-5b47a7e743a6
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-27T19:42:03Z/
url https://huntr.dev/bounties/1a5e6c65-2c5e-4617-9411-5b47a7e743a6
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2614
reference_id CVE-2023-2614
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2614
5
reference_url https://github.com/advisories/GHSA-m6m9-gr85-79vm
reference_id GHSA-m6m9-gr85-79vm
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-m6m9-gr85-79vm
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-m6m9-gr85-79vm
reference_id GHSA-m6m9-gr85-79vm
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-m6m9-gr85-79vm
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2614, GHSA-m6m9-gr85-79vm
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4dk6-cfer-t7b5
6
url VCID-5qj5-vh6d-7khq
vulnerability_id VCID-5qj5-vh6d-7khq
summary 
Cross-site Scripting (XSS) in Conditions tab of Pricing Rules
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2332
reference_id
reference_type
scores
0
value 3e-05
scoring_system epss
scoring_elements 0.00103
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2332
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-15T21:00:05Z/
url https://github.com/pimcore/pimcore/commit/a4491551967d879141a3fdf0986a9dd3d891abfe
3
reference_url https://huntr.com/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-15T21:00:05Z/
url https://huntr.com/bounties/e436ed71-6741-4b30-89db-f7f3de4aca2c
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2332
reference_id CVE-2023-2332
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2332
5
reference_url https://github.com/advisories/GHSA-r7mm-jx6h-hv7m
reference_id GHSA-r7mm-jx6h-hv7m
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-r7mm-jx6h-hv7m
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-r7mm-jx6h-hv7m
reference_id GHSA-r7mm-jx6h-hv7m
reference_type
scores
0
value 4.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-r7mm-jx6h-hv7m
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2332, GHSA-r7mm-jx6h-hv7m
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5qj5-vh6d-7khq
7
url VCID-5tz5-h4wq-3qfy
vulnerability_id VCID-5tz5-h4wq-3qfy
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2323
reference_id
reference_type
scores
0
value 7e-05
scoring_system epss
scoring_elements 0.00681
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2323
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/e88fa79de7b5903fb58ddbc231130b04d937d79e
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:33:50Z/
url https://github.com/pimcore/pimcore/commit/e88fa79de7b5903fb58ddbc231130b04d937d79e
3
reference_url https://huntr.dev/bounties/41edf190-f6bf-4a29-a237-7ff1b2d048d3
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:33:50Z/
url https://huntr.dev/bounties/41edf190-f6bf-4a29-a237-7ff1b2d048d3
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2323
reference_id CVE-2023-2323
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2323
5
reference_url https://github.com/advisories/GHSA-cjv6-w5hf-5wr6
reference_id GHSA-cjv6-w5hf-5wr6
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-cjv6-w5hf-5wr6
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-cjv6-w5hf-5wr6
reference_id GHSA-cjv6-w5hf-5wr6
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-cjv6-w5hf-5wr6
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2323, GHSA-cjv6-w5hf-5wr6
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5tz5-h4wq-3qfy
8
url VCID-68hd-e927-4kcu
vulnerability_id VCID-68hd-e927-4kcu
summary 
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
The application fails to enforce proper server-side authorization checks on the API endpoint responsible for reading or listing static routes. In Pimcore, static routes are custom URL patterns defined via the backend interface or the var/config/staticroutes.php file, including details like regex-based patterns, controllers, variables, and priorities. These routes are registered automatically through the PimcoreStaticRoutesBundle and integrated into the MVC routing system. Testing revealed that an authenticated backend user lacking explicit permissions was able to invoke the endpoint (e.g., GET /api/static-routes) and retrieve sensitive route configurations. This violates OWASP A01:2021 Broken Access Control, as function-level authorization is absent, allowing unauthorized access to internal routing metadata. Without validation, the endpoint exposes route structures, potentially revealing application architecture, endpoints, or custom logic intended for administrative roles only.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-23494
reference_id
reference_type
scores
0
value 1e-05
scoring_system epss
scoring_elements 0.00014
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-23494
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/pull/18893
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-15T18:08:08Z/
url https://github.com/pimcore/pimcore/pull/18893
3
reference_url https://github.com/pimcore/pimcore/releases/tag/v11.5.14
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-15T18:08:08Z/
url https://github.com/pimcore/pimcore/releases/tag/v11.5.14
4
reference_url https://github.com/pimcore/pimcore/releases/tag/v12.3.1
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-15T18:08:08Z/
url https://github.com/pimcore/pimcore/releases/tag/v12.3.1
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-23494
reference_id CVE-2026-23494
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-23494
6
reference_url https://github.com/advisories/GHSA-m3r2-724c-pwgf
reference_id GHSA-m3r2-724c-pwgf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-m3r2-724c-pwgf
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-m3r2-724c-pwgf
reference_id GHSA-m3r2-724c-pwgf
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-01-15T18:08:08Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-m3r2-724c-pwgf
fixed_packages
0
url pkg:composer/pimcore/pimcore@11.5.14
purl pkg:composer/pimcore/pimcore@11.5.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-f4vw-12f3-wfgb
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.5.14
1
url pkg:composer/pimcore/pimcore@12.3.1
purl pkg:composer/pimcore/pimcore@12.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-f4vw-12f3-wfgb
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@12.3.1
aliases CVE-2026-23494, GHSA-m3r2-724c-pwgf
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-68hd-e927-4kcu
9
url VCID-6w41-7cfk-j7cn
vulnerability_id VCID-6w41-7cfk-j7cn
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2616
reference_id
reference_type
scores
0
value 0.00011
scoring_system epss
scoring_elements 0.01364
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2616
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-27T19:40:53Z/
url https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091
3
reference_url https://huntr.dev/bounties/564cb512-2bcc-4458-8c20-88110ab45801
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-27T19:40:53Z/
url https://huntr.dev/bounties/564cb512-2bcc-4458-8c20-88110ab45801
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2616
reference_id CVE-2023-2616
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2616
5
reference_url https://github.com/advisories/GHSA-mhpj-7m7h-8p6x
reference_id GHSA-mhpj-7m7h-8p6x
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mhpj-7m7h-8p6x
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-mhpj-7m7h-8p6x
reference_id GHSA-mhpj-7m7h-8p6x
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-mhpj-7m7h-8p6x
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2616, GHSA-mhpj-7m7h-8p6x
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6w41-7cfk-j7cn
10
url VCID-81mh-qb4b-n7a8
vulnerability_id VCID-81mh-qb4b-n7a8
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 11.0.0.
references
0
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
1
reference_url https://github.com/pimcore/pimcore/commit/da2af2d413b144b9a742118124457d13232d31fd
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/commit/da2af2d413b144b9a742118124457d13232d31fd
2
reference_url https://huntr.dev/bounties/04447124-c7d4-477f-8364-91fe5b59cda0
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://huntr.dev/bounties/04447124-c7d4-477f-8364-91fe5b59cda0
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1247
reference_id CVE-2023-1247
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1247
4
reference_url https://github.com/advisories/GHSA-8wg7-88cg-7p9j
reference_id GHSA-8wg7-88cg-7p9j
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8wg7-88cg-7p9j
fixed_packages
0
url pkg:composer/pimcore/pimcore@11.0.0
purl pkg:composer/pimcore/pimcore@11.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-b518-ye2d-sbdh
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0
aliases CVE-2023-1247, GHSA-8wg7-88cg-7p9j
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-81mh-qb4b-n7a8
11
url VCID-93rb-sj45-w3fh
vulnerability_id VCID-93rb-sj45-w3fh
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1429
reference_id
reference_type
scores
0
value 0.00017
scoring_system epss
scoring_elements 0.04721
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1429
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/7588c336edb24050656111b89d69e69cc9feb5f5
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-26T21:15:52Z/
url https://github.com/pimcore/pimcore/commit/7588c336edb24050656111b89d69e69cc9feb5f5
3
reference_url https://huntr.dev/bounties/e0829fea-e458-47b8-84a3-a74476d9638f
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-26T21:15:52Z/
url https://huntr.dev/bounties/e0829fea-e458-47b8-84a3-a74476d9638f
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1429
reference_id CVE-2023-1429
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1429
5
reference_url https://github.com/advisories/GHSA-3223-w774-99fq
reference_id GHSA-3223-w774-99fq
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3223-w774-99fq
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-3223-w774-99fq
reference_id GHSA-3223-w774-99fq
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-3223-w774-99fq
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
aliases CVE-2023-1429, GHSA-3223-w774-99fq
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-93rb-sj45-w3fh
12
url VCID-979q-g8dh-1fgw
vulnerability_id VCID-979q-g8dh-1fgw
summary 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2336
reference_id
reference_type
scores
0
value 0.00011
scoring_system epss
scoring_elements 0.01596
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2336
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/498cadec2292f7842fb10612068ac78496e884b4
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:50:58Z/
url https://github.com/pimcore/pimcore/commit/498cadec2292f7842fb10612068ac78496e884b4
3
reference_url https://huntr.dev/bounties/af764624-7746-4f53-8480-85348dbb4f14
reference_id
reference_type
scores
0
value 5.5
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:50:58Z/
url https://huntr.dev/bounties/af764624-7746-4f53-8480-85348dbb4f14
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2336
reference_id CVE-2023-2336
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2336
5
reference_url https://github.com/advisories/GHSA-hg77-vx9v-f49x
reference_id GHSA-hg77-vx9v-f49x
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-hg77-vx9v-f49x
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-hg77-vx9v-f49x
reference_id GHSA-hg77-vx9v-f49x
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-hg77-vx9v-f49x
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2336, GHSA-hg77-vx9v-f49x
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-979q-g8dh-1fgw
13
url VCID-9ra4-dac9-7qba
vulnerability_id VCID-9ra4-dac9-7qba
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2339
reference_id
reference_type
scores
0
value 7e-05
scoring_system epss
scoring_elements 0.00527
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2339
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/6946f8a5a0a93b516c49f17a5b45044eebd73480
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-30T21:26:57Z/
url https://github.com/pimcore/pimcore/commit/6946f8a5a0a93b516c49f17a5b45044eebd73480
3
reference_url https://huntr.dev/bounties/bb1537a5-fe7b-4c77-a582-10a82435fbc2
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-30T21:26:57Z/
url https://huntr.dev/bounties/bb1537a5-fe7b-4c77-a582-10a82435fbc2
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2339
reference_id CVE-2023-2339
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2339
5
reference_url https://github.com/advisories/GHSA-6fvf-x8c6-2f6j
reference_id GHSA-6fvf-x8c6-2f6j
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6fvf-x8c6-2f6j
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-6fvf-x8c6-2f6j
reference_id GHSA-6fvf-x8c6-2f6j
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-6fvf-x8c6-2f6j
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2339, GHSA-6fvf-x8c6-2f6j
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9ra4-dac9-7qba
14
url VCID-bb65-xxsn-m3gv
vulnerability_id VCID-bb65-xxsn-m3gv
summary
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-27617
reference_id
reference_type
scores
0
value 0.00544
scoring_system epss
scoring_elements 0.6805
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-27617
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-12T15:29:36Z/
url https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47
3
reference_url https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-12T15:29:36Z/
url https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Multiselect.php#L332-L347
4
reference_url https://github.com/pimcore/pimcore/commit/19a8520895484e68fd254773e32476565d91deea
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-12T15:29:36Z/
url https://github.com/pimcore/pimcore/commit/19a8520895484e68fd254773e32476565d91deea
5
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-qjpx-5m2p-5pgh
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-03-12T15:29:36Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-qjpx-5m2p-5pgh
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-27617
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-27617
7
reference_url https://github.com/advisories/GHSA-qjpx-5m2p-5pgh
reference_id GHSA-qjpx-5m2p-5pgh
reference_type
scores
url https://github.com/advisories/GHSA-qjpx-5m2p-5pgh
fixed_packages
0
url pkg:composer/pimcore/pimcore@11.5.4
purl pkg:composer/pimcore/pimcore@11.5.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-f4vw-12f3-wfgb
2
vulnerability VCID-f5cg-bkw2-hqct
3
vulnerability VCID-uaf3-v6zj-uuc3
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.5.4
aliases CVE-2025-27617, GHSA-qjpx-5m2p-5pgh
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bb65-xxsn-m3gv
15
url VCID-c2j7-ywhr-3ff3
vulnerability_id VCID-c2j7-ywhr-3ff3
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2630
reference_id
reference_type
scores
0
value 0.0001
scoring_system epss
scoring_elements 0.01279
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2630
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38
reference_id
reference_type
scores
0
value 5.7
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:H
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-27T19:39:45Z/
url https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38
3
reference_url https://huntr.dev/bounties/e1001870-b8d8-4921-8b9c-bbdfb1a1491e
reference_id
reference_type
scores
0
value 5.7
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:H
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-27T19:39:45Z/
url https://huntr.dev/bounties/e1001870-b8d8-4921-8b9c-bbdfb1a1491e
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2630
reference_id CVE-2023-2630
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2630
5
reference_url https://github.com/advisories/GHSA-w766-3572-f2hv
reference_id GHSA-w766-3572-f2hv
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-w766-3572-f2hv
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-w766-3572-f2hv
reference_id GHSA-w766-3572-f2hv
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-w766-3572-f2hv
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2630, GHSA-w766-3572-f2hv
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-c2j7-ywhr-3ff3
16
url VCID-c5af-wpgt-dkep
vulnerability_id VCID-c5af-wpgt-dkep
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2343
reference_id
reference_type
scores
0
value 9e-05
scoring_system epss
scoring_elements 0.01018
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2343
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-30T20:04:53Z/
url https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e
3
reference_url https://huntr.dev/bounties/2fa17227-a717-4b66-ab5a-16bffbb4edb2
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-30T20:04:53Z/
url https://huntr.dev/bounties/2fa17227-a717-4b66-ab5a-16bffbb4edb2
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2343
reference_id CVE-2023-2343
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2343
5
reference_url https://github.com/advisories/GHSA-9q7q-r54q-3f3g
reference_id GHSA-9q7q-r54q-3f3g
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-9q7q-r54q-3f3g
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-9q7q-r54q-3f3g
reference_id GHSA-9q7q-r54q-3f3g
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-9q7q-r54q-3f3g
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2343, GHSA-9q7q-r54q-3f3g
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-c5af-wpgt-dkep
17
url VCID-cbx2-f95n-kqgd
vulnerability_id VCID-cbx2-f95n-kqgd
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-4453
reference_id
reference_type
scores
0
value 3e-05
scoring_system epss
scoring_elements 0.00118
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-4453
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e
reference_id
reference_type
scores
0
value 6.4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-03T14:05:40Z/
url https://github.com/pimcore/pimcore/commit/234c0c02ea7502071b00ab673fbe4a6ac253080e
3
reference_url https://huntr.dev/bounties/245a8785-0fc0-4561-b181-fa20f869d993
reference_id
reference_type
scores
0
value 6.4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-03T14:05:40Z/
url https://huntr.dev/bounties/245a8785-0fc0-4561-b181-fa20f869d993
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-4453
reference_id CVE-2023-4453
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-4453
5
reference_url https://github.com/advisories/GHSA-599v-h3q5-g6r9
reference_id GHSA-599v-h3q5-g6r9
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-599v-h3q5-g6r9
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-599v-h3q5-g6r9
reference_id GHSA-599v-h3q5-g6r9
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-599v-h3q5-g6r9
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.6.8
purl pkg:composer/pimcore/pimcore@10.6.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-bb65-xxsn-m3gv
2
vulnerability VCID-dhdb-wakw-pufe
3
vulnerability VCID-f4vw-12f3-wfgb
4
vulnerability VCID-f5cg-bkw2-hqct
5
vulnerability VCID-uaf3-v6zj-uuc3
6
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.6.8
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-4453, GHSA-599v-h3q5-g6r9
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cbx2-f95n-kqgd
18
url VCID-cgzf-jppn-q7ff
vulnerability_id VCID-cgzf-jppn-q7ff
summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pimcore/pimcore.
references
0
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
1
reference_url https://github.com/advisories/GHSA-rrwm-8wqm-gwgv
reference_id GHSA-rrwm-8wqm-gwgv
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rrwm-8wqm-gwgv
2
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-rrwm-8wqm-gwgv
reference_id GHSA-rrwm-8wqm-gwgv
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-rrwm-8wqm-gwgv
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
aliases GHSA-rrwm-8wqm-gwgv, GMS-2023-781
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cgzf-jppn-q7ff
19
url VCID-d7zd-p4g6-ryd1
vulnerability_id VCID-d7zd-p4g6-ryd1
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1515
reference_id
reference_type
scores
0
value 0.00016
scoring_system epss
scoring_elements 0.04022
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1515
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/44c6b37aa649a0e3105fa41f3d74a3e511acf964
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-26T19:23:15Z/
url https://github.com/pimcore/pimcore/commit/44c6b37aa649a0e3105fa41f3d74a3e511acf964
3
reference_url https://github.com/pimcore/pimcore/pull/14562
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14562
4
reference_url https://github.com/pimcore/pimcore/pull/14562.patch
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14562.patch
5
reference_url https://huntr.dev/bounties/ae0f2ec4-a245-4d0b-9d4d-bd8310dd6282
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-26T19:23:15Z/
url https://huntr.dev/bounties/ae0f2ec4-a245-4d0b-9d4d-bd8310dd6282
6
reference_url https://huntr.dev/bounties/ae0f2ec4-a245-4d0b-9d4d-bd8310dd6282/
reference_id
reference_type
scores
url https://huntr.dev/bounties/ae0f2ec4-a245-4d0b-9d4d-bd8310dd6282/
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1515
reference_id CVE-2023-1515
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1515
8
reference_url https://github.com/advisories/GHSA-66cm-c7ch-5j8q
reference_id GHSA-66cm-c7ch-5j8q
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-66cm-c7ch-5j8q
9
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-66cm-c7ch-5j8q
reference_id GHSA-66cm-c7ch-5j8q
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-66cm-c7ch-5j8q
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
aliases CVE-2023-1515, GHSA-66cm-c7ch-5j8q
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-d7zd-p4g6-ryd1
20
url VCID-de3u-8wqt-uyc2
vulnerability_id VCID-de3u-8wqt-uyc2
summary 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `AssetController::importServerFilesAction`, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite.
The impact of this vulnerability allows attackers to: overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information. This could also cause a denial of service (DoS) if critical system files are overwritten or deleted.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-38708
reference_id
reference_type
scores
0
value 4e-05
scoring_system epss
scoring_elements 0.00194
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-38708
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/58012d0e3b8b926fb54eccbd64ec5c993b30c22c
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-03T18:21:04Z/
url https://github.com/pimcore/pimcore/commit/58012d0e3b8b926fb54eccbd64ec5c993b30c22c
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-38708
reference_id CVE-2023-38708
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-38708
4
reference_url https://github.com/advisories/GHSA-34hj-v8fm-x887
reference_id GHSA-34hj-v8fm-x887
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-34hj-v8fm-x887
5
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-34hj-v8fm-x887
reference_id GHSA-34hj-v8fm-x887
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-03T18:21:04Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-34hj-v8fm-x887
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.6.7
purl pkg:composer/pimcore/pimcore@10.6.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-bb65-xxsn-m3gv
2
vulnerability VCID-cbx2-f95n-kqgd
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-uaf3-v6zj-uuc3
7
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.6.7
aliases CVE-2023-38708, GHSA-34hj-v8fm-x887
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-de3u-8wqt-uyc2
21
url VCID-dhdb-wakw-pufe
vulnerability_id VCID-dhdb-wakw-pufe
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-5873
reference_id
reference_type
scores
0
value 4e-05
scoring_system epss
scoring_elements 0.00149
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-5873
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-27T20:32:14Z/
url https://github.com/pimcore/pimcore/commit/757375677dc83a44c6c22f26d97452cc5cda5d7c
3
reference_url https://huntr.com/bounties/701cfc30-22a1-4c4b-9b2f-885c77c290ce
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-27T20:32:14Z/
url https://huntr.com/bounties/701cfc30-22a1-4c4b-9b2f-885c77c290ce
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-5873
reference_id CVE-2023-5873
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-5873
5
reference_url https://github.com/advisories/GHSA-j59v-hh4p-q92m
reference_id GHSA-j59v-hh4p-q92m
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-j59v-hh4p-q92m
fixed_packages
0
url pkg:composer/pimcore/pimcore@11.1.0
purl pkg:composer/pimcore/pimcore@11.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-b518-ye2d-sbdh
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-f4vw-12f3-wfgb
4
vulnerability VCID-f5cg-bkw2-hqct
5
vulnerability VCID-pvmk-ymnm-uyah
6
vulnerability VCID-uaf3-v6zj-uuc3
7
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.1.0
aliases CVE-2023-5873, GHSA-j59v-hh4p-q92m
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dhdb-wakw-pufe
22
url VCID-drty-cbue-3kcv
vulnerability_id VCID-drty-cbue-3kcv
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2342
reference_id
reference_type
scores
0
value 0.00013
scoring_system epss
scoring_elements 0.02136
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2342
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:31:26Z/
url https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564
3
reference_url https://huntr.dev/bounties/01cd3ed5-dce8-4021-9de0-81cb14bf1829
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:31:26Z/
url https://huntr.dev/bounties/01cd3ed5-dce8-4021-9de0-81cb14bf1829
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2342
reference_id CVE-2023-2342
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2342
5
reference_url https://github.com/advisories/GHSA-2c67-p4xh-m34w
reference_id GHSA-2c67-p4xh-m34w
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-2c67-p4xh-m34w
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-2c67-p4xh-m34w
reference_id GHSA-2c67-p4xh-m34w
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-2c67-p4xh-m34w
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2342, GHSA-2c67-p4xh-m34w
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-drty-cbue-3kcv
23
url VCID-e11t-ywn5-v7gp
vulnerability_id VCID-e11t-ywn5-v7gp
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2322
reference_id
reference_type
scores
0
value 0.00012
scoring_system epss
scoring_elements 0.01689
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2322
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/9fc674892b8b53103098b9524705074a45e7f773
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H
1
value 5.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:34:58Z/
url https://github.com/pimcore/pimcore/commit/9fc674892b8b53103098b9524705074a45e7f773
3
reference_url https://huntr.dev/bounties/f7228f3f-3bef-46fe-b0e3-56c432048a67
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H
1
value 5.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:34:58Z/
url https://huntr.dev/bounties/f7228f3f-3bef-46fe-b0e3-56c432048a67
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2322
reference_id CVE-2023-2322
reference_type
scores
0
value 5.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2322
5
reference_url https://github.com/advisories/GHSA-476g-v7hf-cw5m
reference_id GHSA-476g-v7hf-cw5m
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-476g-v7hf-cw5m
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-476g-v7hf-cw5m
reference_id GHSA-476g-v7hf-cw5m
reference_type
scores
0
value 5.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-476g-v7hf-cw5m
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2322, GHSA-476g-v7hf-cw5m
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-e11t-ywn5-v7gp
24
url VCID-f4vw-12f3-wfgb
vulnerability_id VCID-f4vw-12f3-wfgb
summary 
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
The filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries.

Affected code in models/Dependency/Dao.php:
- getFilterRequiresByPath() lines 90, 95, 100
- getFilterRequiredByPath() lines 148, 153, 158

All 6 locations use direct string concatenation like:

"AND LOWER(CONCAT(o.path, o.key)) RLIKE '".$value."'"

Note that $orderBy and $orderDirection in the same methods (lines 75-81) ARE properly `whitelist`-validated, but $value has zero sanitization.

Entry points (pimcore/admin-ui-classic-bundle ElementController.php):
- GET /admin/element/get-requires-dependencies (line 654)
- GET /admin/element/get-required-by-dependencies (line 714)

The controller JSON-decodes the filter query param and passes $filter['value'] straight to the Dao without any escaping.

PoC (time-based blind):
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-27461
reference_id
reference_type
scores
0
value 0.00013
scoring_system epss
scoring_elements 0.02473
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-27461
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-24T18:56:21Z/
url https://github.com/pimcore/pimcore/commit/1c3925fbec4895abeb21e5c244a83679c4e4a6f4
3
reference_url https://github.com/pimcore/pimcore/pull/18991
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-24T18:56:21Z/
url https://github.com/pimcore/pimcore/pull/18991
4
reference_url https://github.com/pimcore/pimcore/releases/tag/v12.3.3
reference_id
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-24T18:56:21Z/
url https://github.com/pimcore/pimcore/releases/tag/v12.3.3
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-27461
reference_id CVE-2026-27461
reference_type
scores
0
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-27461
6
reference_url https://github.com/advisories/GHSA-vxg3-v4p6-f3fp
reference_id GHSA-vxg3-v4p6-f3fp
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vxg3-v4p6-f3fp
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp
reference_id GHSA-vxg3-v4p6-f3fp
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value 6.9
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-02-24T18:56:21Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-vxg3-v4p6-f3fp
fixed_packages
0
url pkg:composer/pimcore/pimcore@12.0.0-RC1
purl pkg:composer/pimcore/pimcore@12.0.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-f5cg-bkw2-hqct
2
vulnerability VCID-uaf3-v6zj-uuc3
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@12.0.0-RC1
1
url pkg:composer/pimcore/pimcore@12.3.3
purl pkg:composer/pimcore/pimcore@12.3.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ju46-yy7m-2yhv
1
vulnerability VCID-tndt-gq2j-7fcy
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@12.3.3
aliases CVE-2026-27461, GHSA-vxg3-v4p6-f3fp
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f4vw-12f3-wfgb
25
url VCID-f5cg-bkw2-hqct
vulnerability_id VCID-f5cg-bkw2-hqct
summary 
Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
The http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-23493
reference_id
reference_type
scores
0
value 1e-05
scoring_system epss
scoring_elements 5e-05
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-23493
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-15T19:02:04Z/
url https://github.com/pimcore/pimcore/commit/002ec7d5f84973819236796e5b314703b58e8601
3
reference_url https://github.com/pimcore/pimcore/pull/18918
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-15T19:02:04Z/
url https://github.com/pimcore/pimcore/pull/18918
4
reference_url https://github.com/pimcore/pimcore/releases/tag/v11.5.14
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-15T19:02:04Z/
url https://github.com/pimcore/pimcore/releases/tag/v11.5.14
5
reference_url https://github.com/pimcore/pimcore/releases/tag/v12.3.1
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-15T19:02:04Z/
url https://github.com/pimcore/pimcore/releases/tag/v12.3.1
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-23493
reference_id CVE-2026-23493
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-23493
7
reference_url https://github.com/advisories/GHSA-q433-j342-rp9h
reference_id GHSA-q433-j342-rp9h
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-q433-j342-rp9h
8
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
reference_id GHSA-q433-j342-rp9h
reference_type
scores
0
value 8.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-15T19:02:04Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-q433-j342-rp9h
fixed_packages
0
url pkg:composer/pimcore/pimcore@11.5.14
purl pkg:composer/pimcore/pimcore@11.5.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-f4vw-12f3-wfgb
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.5.14
1
url pkg:composer/pimcore/pimcore@12.3.1
purl pkg:composer/pimcore/pimcore@12.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-f4vw-12f3-wfgb
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@12.3.1
aliases CVE-2026-23493, GHSA-q433-j342-rp9h
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f5cg-bkw2-hqct
26
url VCID-f7yk-9pys-t7dr
vulnerability_id VCID-f7yk-9pys-t7dr
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1703
reference_id
reference_type
scores
0
value 9e-05
scoring_system epss
scoring_elements 0.00885
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1703
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/765832f0dc5f6cfb296a82e089b701066f27bcef
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T19:31:27Z/
url https://github.com/pimcore/pimcore/commit/765832f0dc5f6cfb296a82e089b701066f27bcef
3
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-4f25-2x2c-vg6v
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-4f25-2x2c-vg6v
4
reference_url https://huntr.dev/bounties/d12d105c-18fa-4d08-b591-b0e89e39eec1
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T19:31:27Z/
url https://huntr.dev/bounties/d12d105c-18fa-4d08-b591-b0e89e39eec1
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1703
reference_id CVE-2023-1703
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1703
6
reference_url https://github.com/advisories/GHSA-3r5c-h7g6-cqw7
reference_id GHSA-3r5c-h7g6-cqw7
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-3r5c-h7g6-cqw7
7
reference_url https://github.com/advisories/GHSA-4f25-2x2c-vg6v
reference_id GHSA-4f25-2x2c-vg6v
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4f25-2x2c-vg6v
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.20
purl pkg:composer/pimcore/pimcore@10.5.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-4dk6-cfer-t7b5
3
vulnerability VCID-5qj5-vh6d-7khq
4
vulnerability VCID-5tz5-h4wq-3qfy
5
vulnerability VCID-68hd-e927-4kcu
6
vulnerability VCID-6w41-7cfk-j7cn
7
vulnerability VCID-979q-g8dh-1fgw
8
vulnerability VCID-9ra4-dac9-7qba
9
vulnerability VCID-bb65-xxsn-m3gv
10
vulnerability VCID-c2j7-ywhr-3ff3
11
vulnerability VCID-c5af-wpgt-dkep
12
vulnerability VCID-cbx2-f95n-kqgd
13
vulnerability VCID-de3u-8wqt-uyc2
14
vulnerability VCID-dhdb-wakw-pufe
15
vulnerability VCID-drty-cbue-3kcv
16
vulnerability VCID-e11t-ywn5-v7gp
17
vulnerability VCID-f4vw-12f3-wfgb
18
vulnerability VCID-f5cg-bkw2-hqct
19
vulnerability VCID-hed9-c39j-87g2
20
vulnerability VCID-jgxx-v2wj-zkfh
21
vulnerability VCID-jxr2-qjbz-17ha
22
vulnerability VCID-m9aa-5k15-dfap
23
vulnerability VCID-mapb-drtt-rbez
24
vulnerability VCID-mcrd-q5wz-d7dk
25
vulnerability VCID-mwu6-2hxd-efc2
26
vulnerability VCID-n6h3-gsty-sua2
27
vulnerability VCID-q7xb-xff7-77cf
28
vulnerability VCID-uaf3-v6zj-uuc3
29
vulnerability VCID-uxdh-6r6k-h7fr
30
vulnerability VCID-v6d4-h4sz-4yad
31
vulnerability VCID-wzbf-bazj-4kgy
32
vulnerability VCID-xfwh-3838-j7ct
33
vulnerability VCID-xgwg-8q8s-cbfk
34
vulnerability VCID-y92e-mb7u-sueg
35
vulnerability VCID-zbp5-8ec3-gfe4
36
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.20
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-1703, GHSA-3r5c-h7g6-cqw7, GHSA-4f25-2x2c-vg6v
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f7yk-9pys-t7dr
27
url VCID-gs48-295u-mqdt
vulnerability_id VCID-gs48-295u-mqdt
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1286
reference_id
reference_type
scores
0
value 0.00011
scoring_system epss
scoring_elements 0.01433
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1286
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/82cca7f4a7560b160336cce2610481098ca52c18
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-28T16:33:06Z/
url https://github.com/pimcore/pimcore/commit/82cca7f4a7560b160336cce2610481098ca52c18
3
reference_url https://huntr.dev/bounties/31d97442-3f87-439f-83f0-1c7862ef0c7c
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H
1
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-28T16:33:06Z/
url https://huntr.dev/bounties/31d97442-3f87-439f-83f0-1c7862ef0c7c
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1286
reference_id CVE-2023-1286
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1286
5
reference_url https://github.com/advisories/GHSA-8jv7-vwrc-mv4g
reference_id GHSA-8jv7-vwrc-mv4g
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-8jv7-vwrc-mv4g
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-1286, GHSA-8jv7-vwrc-mv4g
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gs48-295u-mqdt
28
url VCID-hed9-c39j-87g2
vulnerability_id VCID-hed9-c39j-87g2
summary 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-3820
reference_id
reference_type
scores
0
value 0.41187
scoring_system epss
scoring_elements 0.97459
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-3820
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-16T13:29:49Z/
url https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
3
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq
4
reference_url https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-16T13:29:49Z/
url https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-3820
reference_id CVE-2023-3820
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-3820
6
reference_url https://github.com/advisories/GHSA-c9hw-557q-f8hq
reference_id GHSA-c9hw-557q-f8hq
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-c9hw-557q-f8hq
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.6.4
purl pkg:composer/pimcore/pimcore@10.6.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-bb65-xxsn-m3gv
2
vulnerability VCID-cbx2-f95n-kqgd
3
vulnerability VCID-de3u-8wqt-uyc2
4
vulnerability VCID-dhdb-wakw-pufe
5
vulnerability VCID-f4vw-12f3-wfgb
6
vulnerability VCID-f5cg-bkw2-hqct
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.6.4
aliases CVE-2023-3820, GHSA-c9hw-557q-f8hq
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hed9-c39j-87g2
29
url VCID-j9qv-7wsq-mkf6
vulnerability_id VCID-j9qv-7wsq-mkf6
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1701
reference_id
reference_type
scores
0
value 0.00016
scoring_system epss
scoring_elements 0.04014
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1701
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/2b997737dd6a60be2239a51dd6d9ef5881568e6d
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T16:52:49Z/
url https://github.com/pimcore/pimcore/commit/2b997737dd6a60be2239a51dd6d9ef5881568e6d
3
reference_url https://github.com/pimcore/pimcore/pull/14721.patch
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14721.patch
4
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-7r35-chv4-xr3r
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-7r35-chv4-xr3r
5
reference_url https://huntr.dev/bounties/64f943c4-68e5-4ef8-82f6-9c4abe928256
reference_id
reference_type
scores
0
value 4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T16:52:49Z/
url https://huntr.dev/bounties/64f943c4-68e5-4ef8-82f6-9c4abe928256
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1701
reference_id CVE-2023-1701
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1701
7
reference_url https://github.com/advisories/GHSA-6mmf-qm37-pmgg
reference_id GHSA-6mmf-qm37-pmgg
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6mmf-qm37-pmgg
8
reference_url https://github.com/advisories/GHSA-7r35-chv4-xr3r
reference_id GHSA-7r35-chv4-xr3r
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-7r35-chv4-xr3r
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.20
purl pkg:composer/pimcore/pimcore@10.5.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-4dk6-cfer-t7b5
3
vulnerability VCID-5qj5-vh6d-7khq
4
vulnerability VCID-5tz5-h4wq-3qfy
5
vulnerability VCID-68hd-e927-4kcu
6
vulnerability VCID-6w41-7cfk-j7cn
7
vulnerability VCID-979q-g8dh-1fgw
8
vulnerability VCID-9ra4-dac9-7qba
9
vulnerability VCID-bb65-xxsn-m3gv
10
vulnerability VCID-c2j7-ywhr-3ff3
11
vulnerability VCID-c5af-wpgt-dkep
12
vulnerability VCID-cbx2-f95n-kqgd
13
vulnerability VCID-de3u-8wqt-uyc2
14
vulnerability VCID-dhdb-wakw-pufe
15
vulnerability VCID-drty-cbue-3kcv
16
vulnerability VCID-e11t-ywn5-v7gp
17
vulnerability VCID-f4vw-12f3-wfgb
18
vulnerability VCID-f5cg-bkw2-hqct
19
vulnerability VCID-hed9-c39j-87g2
20
vulnerability VCID-jgxx-v2wj-zkfh
21
vulnerability VCID-jxr2-qjbz-17ha
22
vulnerability VCID-m9aa-5k15-dfap
23
vulnerability VCID-mapb-drtt-rbez
24
vulnerability VCID-mcrd-q5wz-d7dk
25
vulnerability VCID-mwu6-2hxd-efc2
26
vulnerability VCID-n6h3-gsty-sua2
27
vulnerability VCID-q7xb-xff7-77cf
28
vulnerability VCID-uaf3-v6zj-uuc3
29
vulnerability VCID-uxdh-6r6k-h7fr
30
vulnerability VCID-v6d4-h4sz-4yad
31
vulnerability VCID-wzbf-bazj-4kgy
32
vulnerability VCID-xfwh-3838-j7ct
33
vulnerability VCID-xgwg-8q8s-cbfk
34
vulnerability VCID-y92e-mb7u-sueg
35
vulnerability VCID-zbp5-8ec3-gfe4
36
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.20
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-1701, GHSA-6mmf-qm37-pmgg, GHSA-7r35-chv4-xr3r
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-j9qv-7wsq-mkf6
30
url VCID-jgxx-v2wj-zkfh
vulnerability_id VCID-jgxx-v2wj-zkfh
summary 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2338
reference_id
reference_type
scores
0
value 0.00063
scoring_system epss
scoring_elements 0.19701
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2338
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/21e35af721c375ef4676ed50835e30d828e76520
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-03T16:28:43Z/
url https://github.com/pimcore/pimcore/commit/21e35af721c375ef4676ed50835e30d828e76520
3
reference_url https://huntr.dev/bounties/bbf59fa7-cf5b-4945-81b0-328adc710462
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-03T16:28:43Z/
url https://huntr.dev/bounties/bbf59fa7-cf5b-4945-81b0-328adc710462
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2338
reference_id CVE-2023-2338
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2338
5
reference_url https://github.com/advisories/GHSA-4x35-vr82-xvj6
reference_id GHSA-4x35-vr82-xvj6
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-4x35-vr82-xvj6
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-4x35-vr82-xvj6
reference_id GHSA-4x35-vr82-xvj6
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-4x35-vr82-xvj6
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2338, GHSA-4x35-vr82-xvj6
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jgxx-v2wj-zkfh
31
url VCID-jxr2-qjbz-17ha
vulnerability_id VCID-jxr2-qjbz-17ha
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2361
reference_id
reference_type
scores
0
value 0.00011
scoring_system epss
scoring_elements 0.01589
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2361
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/6970649f5d3790a1db9ef4324bece0d4cb95366a
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-30T20:47:38Z/
url https://github.com/pimcore/pimcore/commit/6970649f5d3790a1db9ef4324bece0d4cb95366a
3
reference_url https://huntr.dev/bounties/24d91b83-c3df-48f5-a713-9def733f2de7
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-30T20:47:38Z/
url https://huntr.dev/bounties/24d91b83-c3df-48f5-a713-9def733f2de7
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2361
reference_id CVE-2023-2361
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2361
5
reference_url https://github.com/advisories/GHSA-9xg6-75mh-7x3f
reference_id GHSA-9xg6-75mh-7x3f
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-9xg6-75mh-7x3f
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-9xg6-75mh-7x3f
reference_id GHSA-9xg6-75mh-7x3f
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-9xg6-75mh-7x3f
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2361, GHSA-9xg6-75mh-7x3f
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jxr2-qjbz-17ha
32
url VCID-m9aa-5k15-dfap
vulnerability_id VCID-m9aa-5k15-dfap
summary 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to receive a patch or, as a workaround, apply the patch manually.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-30848
reference_id
reference_type
scores
0
value 0.00011
scoring_system epss
scoring_elements 0.01556
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-30848
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3
3
reference_url https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3.patch
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3.patch
4
reference_url https://github.com/pimcore/pimcore/pull/14972
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14972
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-30848
reference_id CVE-2023-30848
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-30848
6
reference_url https://github.com/advisories/GHSA-6mhm-gcpf-5gr8
reference_id GHSA-6mhm-gcpf-5gr8
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-6mhm-gcpf-5gr8
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-6mhm-gcpf-5gr8
reference_id GHSA-6mhm-gcpf-5gr8
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-6mhm-gcpf-5gr8
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-30848, GHSA-6mhm-gcpf-5gr8
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-m9aa-5k15-dfap
33
url VCID-mapb-drtt-rbez
vulnerability_id VCID-mapb-drtt-rbez
summary 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-30850
reference_id
reference_type
scores
0
value 0.00064
scoring_system epss
scoring_elements 0.20188
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-30850
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38
3
reference_url https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38.patch
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-30T21:12:49Z/
url https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38.patch
4
reference_url https://github.com/pimcore/pimcore/pull/14952
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-30T21:12:49Z/
url https://github.com/pimcore/pimcore/pull/14952
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-30850
reference_id CVE-2023-30850
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-30850
6
reference_url https://github.com/advisories/GHSA-jwg4-qcgv-5wg6
reference_id GHSA-jwg4-qcgv-5wg6
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-jwg4-qcgv-5wg6
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-jwg4-qcgv-5wg6
reference_id GHSA-jwg4-qcgv-5wg6
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-30T21:12:49Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-jwg4-qcgv-5wg6
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-30850, GHSA-jwg4-qcgv-5wg6
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mapb-drtt-rbez
34
url VCID-mcrd-q5wz-d7dk
vulnerability_id VCID-mcrd-q5wz-d7dk
summary Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-3819
reference_id
reference_type
scores
0
value 2e-05
scoring_system epss
scoring_elements 0.00062
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-3819
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 7.6
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54
reference_id
reference_type
scores
0
value 7.6
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
1
value 7.6
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-16T13:38:48Z/
url https://github.com/pimcore/pimcore/commit/0237527b3244d251fa5ecd4912dfe4f8b2125c54
3
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-r87r-982q-2c3q
reference_id
reference_type
scores
0
value 7.6
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-r87r-982q-2c3q
4
reference_url https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c
reference_id
reference_type
scores
0
value 7.6
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
1
value 7.6
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-16T13:38:48Z/
url https://huntr.dev/bounties/be5e4d4c-1b0b-4c01-a1fc-00533135817c
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-3819
reference_id CVE-2023-3819
reference_type
scores
0
value 7.6
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-3819
6
reference_url https://github.com/advisories/GHSA-r87r-982q-2c3q
reference_id GHSA-r87r-982q-2c3q
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-r87r-982q-2c3q
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.6.4
purl pkg:composer/pimcore/pimcore@10.6.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-bb65-xxsn-m3gv
2
vulnerability VCID-cbx2-f95n-kqgd
3
vulnerability VCID-de3u-8wqt-uyc2
4
vulnerability VCID-dhdb-wakw-pufe
5
vulnerability VCID-f4vw-12f3-wfgb
6
vulnerability VCID-f5cg-bkw2-hqct
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.6.4
aliases CVE-2023-3819, GHSA-r87r-982q-2c3q
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mcrd-q5wz-d7dk
35
url VCID-mwu6-2hxd-efc2
vulnerability_id VCID-mwu6-2hxd-efc2
summary 
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the `scriptPath` and `scripts` parameters. The `scriptPath` parameter is not sanitized properly and is vulnerable to path traversal attack. Any JavaScript/CSS file from the application server can be read by specifying sufficient number of `../` patterns to go out from the application webroot followed by path of the folder where the file is located in the "scriptPath" parameter and the file name in the "scripts" parameter. The JavaScript file is successfully read only if the web application has read access to it. Users should update to version 10.5.21 to receive a patch or, as a workaround, apply the patch manual.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-30852
reference_id
reference_type
scores
0
value 0.0001
scoring_system epss
scoring_elements 0.01133
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-30852
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 4.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/498cadec2292f7842fb10612068ac78496e884b4.patch
reference_id
reference_type
scores
0
value 4.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-30T19:34:59Z/
url https://github.com/pimcore/pimcore/commit/498cadec2292f7842fb10612068ac78496e884b4.patch
3
reference_url https://github.com/pimcore/pimcore/pull/14959
reference_id
reference_type
scores
0
value 4.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-30T19:34:59Z/
url https://github.com/pimcore/pimcore/pull/14959
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-30852
reference_id CVE-2023-30852
reference_type
scores
0
value 4.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-30852
5
reference_url https://github.com/advisories/GHSA-j5c3-r84f-9596
reference_id GHSA-j5c3-r84f-9596
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-j5c3-r84f-9596
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-j5c3-r84f-9596
reference_id GHSA-j5c3-r84f-9596
reference_type
scores
0
value 4.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-30T19:34:59Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-j5c3-r84f-9596
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-30852, GHSA-j5c3-r84f-9596
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mwu6-2hxd-efc2
36
url VCID-n6h3-gsty-sua2
vulnerability_id VCID-n6h3-gsty-sua2
summary 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 to receive a patch or, as a workaround, or apply the patch manually.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-30849
reference_id
reference_type
scores
0
value 0.00064
scoring_system epss
scoring_elements 0.20188
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-30849
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/c6c80905e58c7724c776f980570a56df7016c6d1
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/commit/c6c80905e58c7724c776f980570a56df7016c6d1
3
reference_url https://github.com/pimcore/pimcore/commit/c6c80905e58c7724c776f980570a56df7016c6d1.patch
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-31T18:17:25Z/
url https://github.com/pimcore/pimcore/commit/c6c80905e58c7724c776f980570a56df7016c6d1.patch
4
reference_url https://github.com/pimcore/pimcore/pull/14968
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-31T18:17:25Z/
url https://github.com/pimcore/pimcore/pull/14968
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-30849
reference_id CVE-2023-30849
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-30849
6
reference_url https://github.com/advisories/GHSA-xmg8-w465-mr56
reference_id GHSA-xmg8-w465-mr56
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-xmg8-w465-mr56
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-xmg8-w465-mr56
reference_id GHSA-xmg8-w465-mr56
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-01-31T18:17:25Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-xmg8-w465-mr56
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-30849, GHSA-xmg8-w465-mr56
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-n6h3-gsty-sua2
37
url VCID-p7w5-8ynh-xuh4
vulnerability_id VCID-p7w5-8ynh-xuh4
summary 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1578
reference_id
reference_type
scores
0
value 0.03609
scoring_system epss
scoring_elements 0.87982
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1578
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-25T19:51:39Z/
url https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2
3
reference_url https://github.com/pimcore/pimcore/pull/14538
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14538
4
reference_url https://huntr.dev/bounties/7e441a14-8e55-4ab4-932c-4dc56bb1bc2e
reference_id
reference_type
scores
0
value 6.7
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-02-25T19:51:39Z/
url https://huntr.dev/bounties/7e441a14-8e55-4ab4-932c-4dc56bb1bc2e
5
reference_url https://huntr.dev/bounties/7e441a14-8e55-4ab4-932c-4dc56bb1bc2e/
reference_id
reference_type
scores
url https://huntr.dev/bounties/7e441a14-8e55-4ab4-932c-4dc56bb1bc2e/
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1578
reference_id CVE-2023-1578
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1578
7
reference_url https://github.com/advisories/GHSA-42c3-wvww-gcqj
reference_id GHSA-42c3-wvww-gcqj
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-42c3-wvww-gcqj
8
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-42c3-wvww-gcqj
reference_id GHSA-42c3-wvww-gcqj
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-42c3-wvww-gcqj
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
aliases CVE-2023-1578, GHSA-42c3-wvww-gcqj
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-p7w5-8ynh-xuh4
38
url VCID-q7xb-xff7-77cf
vulnerability_id VCID-q7xb-xff7-77cf
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-3822
reference_id
reference_type
scores
0
value 0.1097
scoring_system epss
scoring_elements 0.9354
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-3822
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/d75888a9b14baaad591548463cca09dfd1395236
reference_id
reference_type
scores
0
value 6
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
1
value 6.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-16T13:11:54Z/
url https://github.com/pimcore/pimcore/commit/d75888a9b14baaad591548463cca09dfd1395236
3
reference_url https://huntr.dev/bounties/2a3a13fe-2a9a-4d1a-8814-fd8ed1e3b1d5
reference_id
reference_type
scores
0
value 6
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
1
value 6.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-16T13:11:54Z/
url https://huntr.dev/bounties/2a3a13fe-2a9a-4d1a-8814-fd8ed1e3b1d5
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-3822
reference_id CVE-2023-3822
reference_type
scores
0
value 6.0
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-3822
5
reference_url https://github.com/advisories/GHSA-vmpv-qjhq-r463
reference_id GHSA-vmpv-qjhq-r463
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vmpv-qjhq-r463
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.6.4
purl pkg:composer/pimcore/pimcore@10.6.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-bb65-xxsn-m3gv
2
vulnerability VCID-cbx2-f95n-kqgd
3
vulnerability VCID-de3u-8wqt-uyc2
4
vulnerability VCID-dhdb-wakw-pufe
5
vulnerability VCID-f4vw-12f3-wfgb
6
vulnerability VCID-f5cg-bkw2-hqct
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.6.4
aliases CVE-2023-3822, GHSA-vmpv-qjhq-r463
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-q7xb-xff7-77cf
39
url VCID-qn3n-hpd2-7baf
vulnerability_id VCID-qn3n-hpd2-7baf
summary 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-28438
reference_id
reference_type
scores
0
value 0.00023
scoring_system epss
scoring_elements 0.06824
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-28438
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch
reference_id
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:17Z/
url https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch
3
reference_url https://github.com/pimcore/pimcore/pull/14526
reference_id
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:17Z/
url https://github.com/pimcore/pimcore/pull/14526
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-28438
reference_id CVE-2023-28438
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-28438
5
reference_url https://github.com/advisories/GHSA-vf7q-g2pv-jxvx
reference_id GHSA-vf7q-g2pv-jxvx
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-vf7q-g2pv-jxvx
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-vf7q-g2pv-jxvx
reference_id GHSA-vf7q-g2pv-jxvx
reference_type
scores
0
value 6.2
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:17Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-vf7q-g2pv-jxvx
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
aliases CVE-2023-28438, GHSA-vf7q-g2pv-jxvx
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qn3n-hpd2-7baf
40
url VCID-qv8v-b5t4-jqb9
vulnerability_id VCID-qv8v-b5t4-jqb9
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-28106
reference_id
reference_type
scores
0
value 0.0007
scoring_system epss
scoring_elements 0.21598
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-28106
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/c59d0bf1d03a5037b586fe06230694fa3818dbf2
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:29:14Z/
url https://github.com/pimcore/pimcore/commit/c59d0bf1d03a5037b586fe06230694fa3818dbf2
3
reference_url https://github.com/pimcore/pimcore/pull/14669.patch
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:29:14Z/
url https://github.com/pimcore/pimcore/pull/14669.patch
4
reference_url https://huntr.dev/bounties/fa77d780-9b23-404b-8c44-12108881d11a
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:29:14Z/
url https://huntr.dev/bounties/fa77d780-9b23-404b-8c44-12108881d11a
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-28106
reference_id CVE-2023-28106
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-28106
6
reference_url https://github.com/advisories/GHSA-x5j3-mq9g-8jc8
reference_id GHSA-x5j3-mq9g-8jc8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-x5j3-mq9g-8jc8
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-x5j3-mq9g-8jc8
reference_id GHSA-x5j3-mq9g-8jc8
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
3
value MODERATE
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:29:14Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-x5j3-mq9g-8jc8
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
aliases CVE-2023-28106, GHSA-x5j3-mq9g-8jc8
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qv8v-b5t4-jqb9
41
url VCID-t6ek-fzh4-mbdu
vulnerability_id VCID-t6ek-fzh4-mbdu
summary 
Reflected XSS in Application Logger module
### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14606.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14606.patch manually.

### References
https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356/
references
0
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
1
reference_url https://github.com/pimcore/pimcore/pull/14606
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14606
2
reference_url https://github.com/pimcore/pimcore/pull/14606.patch
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14606.patch
3
reference_url https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356
4
reference_url https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356/
reference_id
reference_type
scores
url https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356/
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1312
reference_id CVE-2023-1312
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1312
6
reference_url https://github.com/advisories/GHSA-2xpm-cmvw-3jcc
reference_id GHSA-2xpm-cmvw-3jcc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-2xpm-cmvw-3jcc
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-2xpm-cmvw-3jcc
reference_id GHSA-2xpm-cmvw-3jcc
reference_type
scores
0
value 4.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-2xpm-cmvw-3jcc
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
aliases GHSA-2xpm-cmvw-3jcc, GMS-2023-779
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-t6ek-fzh4-mbdu
42
url VCID-tkcj-gar9-dbbh
vulnerability_id VCID-tkcj-gar9-dbbh
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1704
reference_id
reference_type
scores
0
value 0.00015
scoring_system epss
scoring_elements 0.03625
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1704
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/295f5e8d108b68198e36399bea0f69598eb108a0
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T19:30:59Z/
url https://github.com/pimcore/pimcore/commit/295f5e8d108b68198e36399bea0f69598eb108a0
3
reference_url https://github.com/pimcore/pimcore/pull/14732.patch
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14732.patch
4
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-hfmg-g39c-5444
reference_id
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-hfmg-g39c-5444
5
reference_url https://huntr.dev/bounties/84419c7b-ae29-401b-bdfd-5d0c498d320f
reference_id
reference_type
scores
0
value 5.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-12T19:30:59Z/
url https://huntr.dev/bounties/84419c7b-ae29-401b-bdfd-5d0c498d320f
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1704
reference_id CVE-2023-1704
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1704
7
reference_url https://github.com/advisories/GHSA-hfmg-g39c-5444
reference_id GHSA-hfmg-g39c-5444
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-hfmg-g39c-5444
8
reference_url https://github.com/advisories/GHSA-rp78-4562-gx3c
reference_id GHSA-rp78-4562-gx3c
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rp78-4562-gx3c
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.20
purl pkg:composer/pimcore/pimcore@10.5.20
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-4dk6-cfer-t7b5
3
vulnerability VCID-5qj5-vh6d-7khq
4
vulnerability VCID-5tz5-h4wq-3qfy
5
vulnerability VCID-68hd-e927-4kcu
6
vulnerability VCID-6w41-7cfk-j7cn
7
vulnerability VCID-979q-g8dh-1fgw
8
vulnerability VCID-9ra4-dac9-7qba
9
vulnerability VCID-bb65-xxsn-m3gv
10
vulnerability VCID-c2j7-ywhr-3ff3
11
vulnerability VCID-c5af-wpgt-dkep
12
vulnerability VCID-cbx2-f95n-kqgd
13
vulnerability VCID-de3u-8wqt-uyc2
14
vulnerability VCID-dhdb-wakw-pufe
15
vulnerability VCID-drty-cbue-3kcv
16
vulnerability VCID-e11t-ywn5-v7gp
17
vulnerability VCID-f4vw-12f3-wfgb
18
vulnerability VCID-f5cg-bkw2-hqct
19
vulnerability VCID-hed9-c39j-87g2
20
vulnerability VCID-jgxx-v2wj-zkfh
21
vulnerability VCID-jxr2-qjbz-17ha
22
vulnerability VCID-m9aa-5k15-dfap
23
vulnerability VCID-mapb-drtt-rbez
24
vulnerability VCID-mcrd-q5wz-d7dk
25
vulnerability VCID-mwu6-2hxd-efc2
26
vulnerability VCID-n6h3-gsty-sua2
27
vulnerability VCID-q7xb-xff7-77cf
28
vulnerability VCID-uaf3-v6zj-uuc3
29
vulnerability VCID-uxdh-6r6k-h7fr
30
vulnerability VCID-v6d4-h4sz-4yad
31
vulnerability VCID-wzbf-bazj-4kgy
32
vulnerability VCID-xfwh-3838-j7ct
33
vulnerability VCID-xgwg-8q8s-cbfk
34
vulnerability VCID-y92e-mb7u-sueg
35
vulnerability VCID-zbp5-8ec3-gfe4
36
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.20
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-1704, GHSA-hfmg-g39c-5444, GHSA-rp78-4562-gx3c
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-tkcj-gar9-dbbh
43
url VCID-uaf3-v6zj-uuc3
vulnerability_id VCID-uaf3-v6zj-uuc3
summary 
Pimcore Has an Incomplete Patch for CVE-2023-30848
An **incomplete SQL injection patch** in the Admin Search Find API allows an authenticated attacker to perform **blind SQL injection**.
Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments (--) and catching syntax errors, the fix is insufficient. Attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This vulnerability affects the admin interface and can lead to **database information disclosure**.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2026-23492
reference_id
reference_type
scores
0
value 5e-05
scoring_system epss
scoring_elements 0.0025
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2026-23492
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-01-14T21:14:38Z/
url https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-23492
reference_id CVE-2026-23492
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2026-23492
4
reference_url https://github.com/advisories/GHSA-6mhm-gcpf-5gr8
reference_id GHSA-6mhm-gcpf-5gr8
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/advisories/GHSA-6mhm-gcpf-5gr8
5
reference_url https://github.com/advisories/GHSA-qvr7-7g55-69xj
reference_id GHSA-qvr7-7g55-69xj
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qvr7-7g55-69xj
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-qvr7-7g55-69xj
reference_id GHSA-qvr7-7g55-69xj
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2026-01-14T21:14:38Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-qvr7-7g55-69xj
fixed_packages
0
url pkg:composer/pimcore/pimcore@11.5.14
purl pkg:composer/pimcore/pimcore@11.5.14
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-f4vw-12f3-wfgb
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.5.14
1
url pkg:composer/pimcore/pimcore@12.3.1
purl pkg:composer/pimcore/pimcore@12.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-f4vw-12f3-wfgb
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@12.3.1
aliases CVE-2026-23492, GHSA-qvr7-7g55-69xj
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uaf3-v6zj-uuc3
44
url VCID-uxdh-6r6k-h7fr
vulnerability_id VCID-uxdh-6r6k-h7fr
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2615
reference_id
reference_type
scores
0
value 0.00011
scoring_system epss
scoring_elements 0.01364
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2615
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-27T19:41:26Z/
url https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f
3
reference_url https://huntr.dev/bounties/af9c360a-87f8-4e97-a24b-6db675ee942a
reference_id
reference_type
scores
0
value 6.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-27T19:41:26Z/
url https://huntr.dev/bounties/af9c360a-87f8-4e97-a24b-6db675ee942a
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2615
reference_id CVE-2023-2615
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2615
5
reference_url https://github.com/advisories/GHSA-q7cc-m6jw-m262
reference_id GHSA-q7cc-m6jw-m262
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-q7cc-m6jw-m262
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-q7cc-m6jw-m262
reference_id GHSA-q7cc-m6jw-m262
reference_type
scores
0
value 6.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-q7cc-m6jw-m262
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2615, GHSA-q7cc-m6jw-m262
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-uxdh-6r6k-h7fr
45
url VCID-v6d4-h4sz-4yad
vulnerability_id VCID-v6d4-h4sz-4yad
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2340
reference_id
reference_type
scores
0
value 7e-05
scoring_system epss
scoring_elements 0.00681
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2340
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/aa38319e353cc3cdfac12e03e21ed7a8f3628d3e
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:32:45Z/
url https://github.com/pimcore/pimcore/commit/aa38319e353cc3cdfac12e03e21ed7a8f3628d3e
3
reference_url https://huntr.dev/bounties/964762b0-b4fe-441c-81e1-0ebdbbf80f3b
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:32:45Z/
url https://huntr.dev/bounties/964762b0-b4fe-441c-81e1-0ebdbbf80f3b
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2340
reference_id CVE-2023-2340
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2340
5
reference_url https://github.com/advisories/GHSA-g93x-fm2w-5pxw
reference_id GHSA-g93x-fm2w-5pxw
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-g93x-fm2w-5pxw
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-g93x-fm2w-5pxw
reference_id GHSA-g93x-fm2w-5pxw
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-g93x-fm2w-5pxw
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2340, GHSA-g93x-fm2w-5pxw
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-v6d4-h4sz-4yad
46
url VCID-wdud-ckq4-wqfa
vulnerability_id VCID-wdud-ckq4-wqfa
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-28429
reference_id
reference_type
scores
0
value 0.00012
scoring_system epss
scoring_elements 0.01632
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-28429
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/pull/14574
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:32Z/
url https://github.com/pimcore/pimcore/pull/14574
3
reference_url https://github.com/pimcore/pimcore/pull/14574.patch
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:32Z/
url https://github.com/pimcore/pimcore/pull/14574.patch
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-28429
reference_id CVE-2023-28429
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-28429
5
reference_url https://github.com/advisories/GHSA-rcg9-hrhx-6q69
reference_id GHSA-rcg9-hrhx-6q69
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rcg9-hrhx-6q69
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-rcg9-hrhx-6q69
reference_id GHSA-rcg9-hrhx-6q69
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-25T14:28:32Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-rcg9-hrhx-6q69
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
aliases CVE-2023-28429, GHSA-rcg9-hrhx-6q69
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wdud-ckq4-wqfa
47
url VCID-wzbf-bazj-4kgy
vulnerability_id VCID-wzbf-bazj-4kgy
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-3821
reference_id
reference_type
scores
0
value 6e-05
scoring_system epss
scoring_elements 0.00386
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-3821
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/92811f07d39e4ad95c92003868f5f7309489d79c
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-16T13:28:26Z/
url https://github.com/pimcore/pimcore/commit/92811f07d39e4ad95c92003868f5f7309489d79c
3
reference_url https://huntr.dev/bounties/599ba4f6-c900-4161-9127-f1e6a6e29aaa
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-16T13:28:26Z/
url https://huntr.dev/bounties/599ba4f6-c900-4161-9127-f1e6a6e29aaa
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-3821
reference_id CVE-2023-3821
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-3821
5
reference_url https://github.com/advisories/GHSA-78q2-cv3p-x9fm
reference_id GHSA-78q2-cv3p-x9fm
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-78q2-cv3p-x9fm
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.6.4
purl pkg:composer/pimcore/pimcore@10.6.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-bb65-xxsn-m3gv
2
vulnerability VCID-cbx2-f95n-kqgd
3
vulnerability VCID-de3u-8wqt-uyc2
4
vulnerability VCID-dhdb-wakw-pufe
5
vulnerability VCID-f4vw-12f3-wfgb
6
vulnerability VCID-f5cg-bkw2-hqct
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.6.4
aliases CVE-2023-3821, GHSA-78q2-cv3p-x9fm
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wzbf-bazj-4kgy
48
url VCID-xfwh-3838-j7ct
vulnerability_id VCID-xfwh-3838-j7ct
summary 
Cross-Site Request Forgery (CSRF)
Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of `getFilterCondition()` is in `Multiselect`, which does not normalize/escape/validate the passed value. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. This vulnerability has been addressed in version 11.1.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-47637
reference_id
reference_type
scores
0
value 0.7572
scoring_system epss
scoring_elements 0.98928
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-47637
1
reference_url https://github.com/pimcore/admin-ui-classic-bundle/blob/bba7c7419cb1f06d5fd98781eab4d6995e4e5dca/src/Helper/GridHelperService.php#L311
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-08-29T17:40:14Z/
url https://github.com/pimcore/admin-ui-classic-bundle/blob/bba7c7419cb1f06d5fd98781eab4d6995e4e5dca/src/Helper/GridHelperService.php#L311
2
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
3
reference_url https://github.com/pimcore/pimcore/blob/42b6cfa77c4540205bdd10689893ccb73e4bac8f/models/DataObject/ClassDefinition/Data/Multiselect.php#L285-L312
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/blob/42b6cfa77c4540205bdd10689893ccb73e4bac8f/models/DataObject/ClassDefinition/Data/Multiselect.php#L285-L312
4
reference_url https://github.com/pimcore/pimcore/commit/d164d99c90f098d0ccd6b72929c48b727e2953a0
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-08-29T17:40:14Z/
url https://github.com/pimcore/pimcore/commit/d164d99c90f098d0ccd6b72929c48b727e2953a0
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-47637
reference_id CVE-2023-47637
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-47637
6
reference_url https://github.com/advisories/GHSA-72hh-xf79-429p
reference_id GHSA-72hh-xf79-429p
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-72hh-xf79-429p
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-72hh-xf79-429p
reference_id GHSA-72hh-xf79-429p
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-08-29T17:40:14Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-72hh-xf79-429p
fixed_packages
0
url pkg:composer/pimcore/pimcore@11.1.1
purl pkg:composer/pimcore/pimcore@11.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-692j-q97q-dbd8
2
vulnerability VCID-b518-ye2d-sbdh
3
vulnerability VCID-bb65-xxsn-m3gv
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.1.1
aliases CVE-2023-47637, GHSA-72hh-xf79-429p
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xfwh-3838-j7ct
49
url VCID-xgwg-8q8s-cbfk
vulnerability_id VCID-xgwg-8q8s-cbfk
summary 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-3673
reference_id
reference_type
scores
0
value 0.11372
scoring_system epss
scoring_elements 0.93673
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-3673
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/a06ce0abdba19ae0eefc38b035e677f8f0c2bce9
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-22T15:08:39Z/
url https://github.com/pimcore/pimcore/commit/a06ce0abdba19ae0eefc38b035e677f8f0c2bce9
3
reference_url https://huntr.dev/bounties/46ca0934-5260-477b-9e86-7b16bb18d0a9
reference_id
reference_type
scores
0
value 7.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-22T15:08:39Z/
url https://huntr.dev/bounties/46ca0934-5260-477b-9e86-7b16bb18d0a9
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-3673
reference_id CVE-2023-3673
reference_type
scores
0
value 7.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-3673
5
reference_url https://github.com/advisories/GHSA-rxp5-qwrf-pfv3
reference_id GHSA-rxp5-qwrf-pfv3
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rxp5-qwrf-pfv3
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.24
purl pkg:composer/pimcore/pimcore@10.5.24
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-bb65-xxsn-m3gv
2
vulnerability VCID-cbx2-f95n-kqgd
3
vulnerability VCID-de3u-8wqt-uyc2
4
vulnerability VCID-dhdb-wakw-pufe
5
vulnerability VCID-f4vw-12f3-wfgb
6
vulnerability VCID-f5cg-bkw2-hqct
7
vulnerability VCID-hed9-c39j-87g2
8
vulnerability VCID-mcrd-q5wz-d7dk
9
vulnerability VCID-q7xb-xff7-77cf
10
vulnerability VCID-uaf3-v6zj-uuc3
11
vulnerability VCID-wzbf-bazj-4kgy
12
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.24
aliases CVE-2023-3673, GHSA-rxp5-qwrf-pfv3
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-xgwg-8q8s-cbfk
50
url VCID-y92e-mb7u-sueg
vulnerability_id VCID-y92e-mb7u-sueg
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2328
reference_id
reference_type
scores
0
value 0.00017
scoring_system epss
scoring_elements 0.04721
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2328
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/e3562bfe249c557d15474c9a0acd5e06628521fe
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value 5.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:51:34Z/
url https://github.com/pimcore/pimcore/commit/e3562bfe249c557d15474c9a0acd5e06628521fe
3
reference_url https://huntr.dev/bounties/01a44584-e36b-46f4-ad94-53af488397f6
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value 5.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:51:34Z/
url https://huntr.dev/bounties/01a44584-e36b-46f4-ad94-53af488397f6
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2328
reference_id CVE-2023-2328
reference_type
scores
0
value 5.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2328
5
reference_url https://github.com/advisories/GHSA-2295-vh28-pphc
reference_id GHSA-2295-vh28-pphc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-2295-vh28-pphc
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-2295-vh28-pphc
reference_id GHSA-2295-vh28-pphc
reference_type
scores
0
value 5.2
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-2295-vh28-pphc
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2328, GHSA-2295-vh28-pphc
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-y92e-mb7u-sueg
51
url VCID-ycet-r6tz-yyhn
vulnerability_id VCID-ycet-r6tz-yyhn
summary 
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-28108
reference_id
reference_type
scores
0
value 0.00015
scoring_system epss
scoring_elements 0.03487
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-28108
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 7.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/08e7ba56ae983c3c67ec563b6989b16ef8f35275.patch
reference_id
reference_type
scores
0
value 7.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T14:29:15Z/
url https://github.com/pimcore/pimcore/commit/08e7ba56ae983c3c67ec563b6989b16ef8f35275.patch
3
reference_url https://github.com/pimcore/pimcore/pull/14633
reference_id
reference_type
scores
0
value 7.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T14:29:15Z/
url https://github.com/pimcore/pimcore/pull/14633
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-28108
reference_id CVE-2023-28108
reference_type
scores
0
value 7.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-28108
5
reference_url https://github.com/advisories/GHSA-xc9p-r5qj-8xm9
reference_id GHSA-xc9p-r5qj-8xm9
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-xc9p-r5qj-8xm9
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-xc9p-r5qj-8xm9
reference_id GHSA-xc9p-r5qj-8xm9
reference_type
scores
0
value 7.9
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
1
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
2
value HIGH
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-02-25T14:29:15Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-xc9p-r5qj-8xm9
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.19
purl pkg:composer/pimcore/pimcore@10.5.19
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-3et6-gmgj-h7bn
2
vulnerability VCID-3ref-crmy-eucd
3
vulnerability VCID-4dk6-cfer-t7b5
4
vulnerability VCID-5qj5-vh6d-7khq
5
vulnerability VCID-5tz5-h4wq-3qfy
6
vulnerability VCID-68hd-e927-4kcu
7
vulnerability VCID-6w41-7cfk-j7cn
8
vulnerability VCID-979q-g8dh-1fgw
9
vulnerability VCID-9ra4-dac9-7qba
10
vulnerability VCID-bb65-xxsn-m3gv
11
vulnerability VCID-c2j7-ywhr-3ff3
12
vulnerability VCID-c5af-wpgt-dkep
13
vulnerability VCID-cbx2-f95n-kqgd
14
vulnerability VCID-de3u-8wqt-uyc2
15
vulnerability VCID-dhdb-wakw-pufe
16
vulnerability VCID-drty-cbue-3kcv
17
vulnerability VCID-e11t-ywn5-v7gp
18
vulnerability VCID-f4vw-12f3-wfgb
19
vulnerability VCID-f5cg-bkw2-hqct
20
vulnerability VCID-f7yk-9pys-t7dr
21
vulnerability VCID-hed9-c39j-87g2
22
vulnerability VCID-j9qv-7wsq-mkf6
23
vulnerability VCID-jgxx-v2wj-zkfh
24
vulnerability VCID-jxr2-qjbz-17ha
25
vulnerability VCID-m9aa-5k15-dfap
26
vulnerability VCID-mapb-drtt-rbez
27
vulnerability VCID-mcrd-q5wz-d7dk
28
vulnerability VCID-mwu6-2hxd-efc2
29
vulnerability VCID-n6h3-gsty-sua2
30
vulnerability VCID-q7xb-xff7-77cf
31
vulnerability VCID-tkcj-gar9-dbbh
32
vulnerability VCID-uaf3-v6zj-uuc3
33
vulnerability VCID-uxdh-6r6k-h7fr
34
vulnerability VCID-v6d4-h4sz-4yad
35
vulnerability VCID-wzbf-bazj-4kgy
36
vulnerability VCID-xfwh-3838-j7ct
37
vulnerability VCID-xgwg-8q8s-cbfk
38
vulnerability VCID-y92e-mb7u-sueg
39
vulnerability VCID-zbp5-8ec3-gfe4
40
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.19
aliases CVE-2023-28108, GHSA-xc9p-r5qj-8xm9
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ycet-r6tz-yyhn
52
url VCID-zbp5-8ec3-gfe4
vulnerability_id VCID-zbp5-8ec3-gfe4
summary Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2984
reference_id
reference_type
scores
0
value 7e-05
scoring_system epss
scoring_elements 0.00654
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2984
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-13T19:58:45Z/
url https://github.com/pimcore/pimcore/commit/e8dbc4da58ae86618bceb67ed35ce23e5e54d2ed
3
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-46g3-f9r8-xj4v
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-46g3-f9r8-xj4v
4
reference_url https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-13T19:58:45Z/
url https://huntr.dev/bounties/5df8b951-e2f1-4548-a7e3-601186e1b191
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2984
reference_id CVE-2023-2984
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2984
6
reference_url https://github.com/advisories/GHSA-46g3-f9r8-xj4v
reference_id GHSA-46g3-f9r8-xj4v
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-46g3-f9r8-xj4v
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.22
purl pkg:composer/pimcore/pimcore@10.5.22
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.22
aliases CVE-2023-2984, GHSA-46g3-f9r8-xj4v
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zbp5-8ec3-gfe4
53
url VCID-zth5-afz8-uya7
vulnerability_id VCID-zth5-afz8-uya7
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-2341
reference_id
reference_type
scores
0
value 0.00017
scoring_system epss
scoring_elements 0.04482
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-2341
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:32:03Z/
url https://github.com/pimcore/pimcore/commit/66f1089fb1b9bcd575bfce9b1d4abb0f0499df11
3
reference_url https://huntr.dev/bounties/cf3901ac-a649-478f-ab08-094ef759c11d
reference_id
reference_type
scores
0
value 7.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
1
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-31T18:32:03Z/
url https://huntr.dev/bounties/cf3901ac-a649-478f-ab08-094ef759c11d
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-2341
reference_id CVE-2023-2341
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-2341
5
reference_url https://github.com/advisories/GHSA-fq95-rx4q-qgg2
reference_id GHSA-fq95-rx4q-qgg2
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-fq95-rx4q-qgg2
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-fq95-rx4q-qgg2
reference_id GHSA-fq95-rx4q-qgg2
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-fq95-rx4q-qgg2
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.21
purl pkg:composer/pimcore/pimcore@10.5.21
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hqj-r197-dyfe
1
vulnerability VCID-68hd-e927-4kcu
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-cbx2-f95n-kqgd
4
vulnerability VCID-de3u-8wqt-uyc2
5
vulnerability VCID-dhdb-wakw-pufe
6
vulnerability VCID-f4vw-12f3-wfgb
7
vulnerability VCID-f5cg-bkw2-hqct
8
vulnerability VCID-hed9-c39j-87g2
9
vulnerability VCID-mcrd-q5wz-d7dk
10
vulnerability VCID-q7xb-xff7-77cf
11
vulnerability VCID-uaf3-v6zj-uuc3
12
vulnerability VCID-wzbf-bazj-4kgy
13
vulnerability VCID-xfwh-3838-j7ct
14
vulnerability VCID-xgwg-8q8s-cbfk
15
vulnerability VCID-zbp5-8ec3-gfe4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.21
aliases CVE-2023-2341, GHSA-fq95-rx4q-qgg2
risk_score 3.3
exploitability 0.5
weighted_severity 6.6
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zth5-afz8-uya7
Fixing_vulnerabilities
0
url VCID-4p8y-eknc-zfgn
vulnerability_id VCID-4p8y-eknc-zfgn
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1117
reference_id
reference_type
scores
0
value 8e-05
scoring_system epss
scoring_elements 0.00778
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1117
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/b9ba69f66d6a9986fb36f239661b98cd33a89853
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-07T18:32:19Z/
url https://github.com/pimcore/pimcore/commit/b9ba69f66d6a9986fb36f239661b98cd33a89853
3
reference_url https://huntr.dev/bounties/e8c0044d-a31b-4347-b2d5-59fbf492da39
reference_id
reference_type
scores
0
value 4.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-07T18:32:19Z/
url https://huntr.dev/bounties/e8c0044d-a31b-4347-b2d5-59fbf492da39
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1117
reference_id CVE-2023-1117
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1117
5
reference_url https://github.com/advisories/GHSA-qxcw-rf4v-hp26
reference_id GHSA-qxcw-rf4v-hp26
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qxcw-rf4v-hp26
6
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-qxcw-rf4v-hp26
reference_id GHSA-qxcw-rf4v-hp26
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-qxcw-rf4v-hp26
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.18
purl pkg:composer/pimcore/pimcore@10.5.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-13m1-u59p-eue5
1
vulnerability VCID-1hqj-r197-dyfe
2
vulnerability VCID-354d-zv99-73g6
3
vulnerability VCID-3et6-gmgj-h7bn
4
vulnerability VCID-3ref-crmy-eucd
5
vulnerability VCID-4dk6-cfer-t7b5
6
vulnerability VCID-5qj5-vh6d-7khq
7
vulnerability VCID-5tz5-h4wq-3qfy
8
vulnerability VCID-68hd-e927-4kcu
9
vulnerability VCID-6w41-7cfk-j7cn
10
vulnerability VCID-81mh-qb4b-n7a8
11
vulnerability VCID-93rb-sj45-w3fh
12
vulnerability VCID-979q-g8dh-1fgw
13
vulnerability VCID-9ra4-dac9-7qba
14
vulnerability VCID-bb65-xxsn-m3gv
15
vulnerability VCID-c2j7-ywhr-3ff3
16
vulnerability VCID-c5af-wpgt-dkep
17
vulnerability VCID-cbx2-f95n-kqgd
18
vulnerability VCID-cgzf-jppn-q7ff
19
vulnerability VCID-d7zd-p4g6-ryd1
20
vulnerability VCID-de3u-8wqt-uyc2
21
vulnerability VCID-dhdb-wakw-pufe
22
vulnerability VCID-drty-cbue-3kcv
23
vulnerability VCID-e11t-ywn5-v7gp
24
vulnerability VCID-f4vw-12f3-wfgb
25
vulnerability VCID-f5cg-bkw2-hqct
26
vulnerability VCID-f7yk-9pys-t7dr
27
vulnerability VCID-gs48-295u-mqdt
28
vulnerability VCID-hed9-c39j-87g2
29
vulnerability VCID-j9qv-7wsq-mkf6
30
vulnerability VCID-jgxx-v2wj-zkfh
31
vulnerability VCID-jxr2-qjbz-17ha
32
vulnerability VCID-m9aa-5k15-dfap
33
vulnerability VCID-mapb-drtt-rbez
34
vulnerability VCID-mcrd-q5wz-d7dk
35
vulnerability VCID-mwu6-2hxd-efc2
36
vulnerability VCID-n6h3-gsty-sua2
37
vulnerability VCID-p7w5-8ynh-xuh4
38
vulnerability VCID-q7xb-xff7-77cf
39
vulnerability VCID-qn3n-hpd2-7baf
40
vulnerability VCID-qv8v-b5t4-jqb9
41
vulnerability VCID-t6ek-fzh4-mbdu
42
vulnerability VCID-tkcj-gar9-dbbh
43
vulnerability VCID-uaf3-v6zj-uuc3
44
vulnerability VCID-uxdh-6r6k-h7fr
45
vulnerability VCID-v6d4-h4sz-4yad
46
vulnerability VCID-wdud-ckq4-wqfa
47
vulnerability VCID-wzbf-bazj-4kgy
48
vulnerability VCID-xfwh-3838-j7ct
49
vulnerability VCID-xgwg-8q8s-cbfk
50
vulnerability VCID-y92e-mb7u-sueg
51
vulnerability VCID-ycet-r6tz-yyhn
52
vulnerability VCID-zbp5-8ec3-gfe4
53
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.18
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-1117, GHSA-qxcw-rf4v-hp26
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4p8y-eknc-zfgn
1
url VCID-9m1k-bypd-zber
vulnerability_id VCID-9m1k-bypd-zber
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1116
reference_id
reference_type
scores
0
value 7e-05
scoring_system epss
scoring_elements 0.00681
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1116
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/f6d322efa207a737eedd8726b7c92e957a83341e
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-07T18:32:54Z/
url https://github.com/pimcore/pimcore/commit/f6d322efa207a737eedd8726b7c92e957a83341e
3
reference_url https://github.com/pimcore/pimcore/pull/14467.patch
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14467.patch
4
reference_url https://huntr.dev/bounties/3245ff99-9adf-4db9-af94-f995747e09d1
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-07T18:32:54Z/
url https://huntr.dev/bounties/3245ff99-9adf-4db9-af94-f995747e09d1
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1116
reference_id CVE-2023-1116
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1116
6
reference_url https://github.com/advisories/GHSA-96hp-38wx-j3wc
reference_id GHSA-96hp-38wx-j3wc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-96hp-38wx-j3wc
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-96hp-38wx-j3wc
reference_id GHSA-96hp-38wx-j3wc
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-96hp-38wx-j3wc
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.18
purl pkg:composer/pimcore/pimcore@10.5.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-13m1-u59p-eue5
1
vulnerability VCID-1hqj-r197-dyfe
2
vulnerability VCID-354d-zv99-73g6
3
vulnerability VCID-3et6-gmgj-h7bn
4
vulnerability VCID-3ref-crmy-eucd
5
vulnerability VCID-4dk6-cfer-t7b5
6
vulnerability VCID-5qj5-vh6d-7khq
7
vulnerability VCID-5tz5-h4wq-3qfy
8
vulnerability VCID-68hd-e927-4kcu
9
vulnerability VCID-6w41-7cfk-j7cn
10
vulnerability VCID-81mh-qb4b-n7a8
11
vulnerability VCID-93rb-sj45-w3fh
12
vulnerability VCID-979q-g8dh-1fgw
13
vulnerability VCID-9ra4-dac9-7qba
14
vulnerability VCID-bb65-xxsn-m3gv
15
vulnerability VCID-c2j7-ywhr-3ff3
16
vulnerability VCID-c5af-wpgt-dkep
17
vulnerability VCID-cbx2-f95n-kqgd
18
vulnerability VCID-cgzf-jppn-q7ff
19
vulnerability VCID-d7zd-p4g6-ryd1
20
vulnerability VCID-de3u-8wqt-uyc2
21
vulnerability VCID-dhdb-wakw-pufe
22
vulnerability VCID-drty-cbue-3kcv
23
vulnerability VCID-e11t-ywn5-v7gp
24
vulnerability VCID-f4vw-12f3-wfgb
25
vulnerability VCID-f5cg-bkw2-hqct
26
vulnerability VCID-f7yk-9pys-t7dr
27
vulnerability VCID-gs48-295u-mqdt
28
vulnerability VCID-hed9-c39j-87g2
29
vulnerability VCID-j9qv-7wsq-mkf6
30
vulnerability VCID-jgxx-v2wj-zkfh
31
vulnerability VCID-jxr2-qjbz-17ha
32
vulnerability VCID-m9aa-5k15-dfap
33
vulnerability VCID-mapb-drtt-rbez
34
vulnerability VCID-mcrd-q5wz-d7dk
35
vulnerability VCID-mwu6-2hxd-efc2
36
vulnerability VCID-n6h3-gsty-sua2
37
vulnerability VCID-p7w5-8ynh-xuh4
38
vulnerability VCID-q7xb-xff7-77cf
39
vulnerability VCID-qn3n-hpd2-7baf
40
vulnerability VCID-qv8v-b5t4-jqb9
41
vulnerability VCID-t6ek-fzh4-mbdu
42
vulnerability VCID-tkcj-gar9-dbbh
43
vulnerability VCID-uaf3-v6zj-uuc3
44
vulnerability VCID-uxdh-6r6k-h7fr
45
vulnerability VCID-v6d4-h4sz-4yad
46
vulnerability VCID-wdud-ckq4-wqfa
47
vulnerability VCID-wzbf-bazj-4kgy
48
vulnerability VCID-xfwh-3838-j7ct
49
vulnerability VCID-xgwg-8q8s-cbfk
50
vulnerability VCID-y92e-mb7u-sueg
51
vulnerability VCID-ycet-r6tz-yyhn
52
vulnerability VCID-zbp5-8ec3-gfe4
53
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.18
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-1116, GHSA-96hp-38wx-j3wc
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9m1k-bypd-zber
2
url VCID-jx3r-bxmm-hfaw
vulnerability_id VCID-jx3r-bxmm-hfaw
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1115
reference_id
reference_type
scores
0
value 0.00014
scoring_system epss
scoring_elements 0.02924
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1115
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/c6368b7cc69a3ebf2c83de7586f492ca1f404dd3
reference_id
reference_type
scores
0
value 7.6
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-11T14:15:26Z/
url https://github.com/pimcore/pimcore/commit/c6368b7cc69a3ebf2c83de7586f492ca1f404dd3
3
reference_url https://github.com/pimcore/pimcore/pull/14500.patch
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/pull/14500.patch
4
reference_url https://huntr.dev/bounties/cfa80332-e4cf-4d64-b3e5-e10298628d17
reference_id
reference_type
scores
0
value 7.6
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-11T14:15:26Z/
url https://huntr.dev/bounties/cfa80332-e4cf-4d64-b3e5-e10298628d17
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1115
reference_id CVE-2023-1115
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1115
6
reference_url https://github.com/advisories/GHSA-97cp-8873-v2gf
reference_id GHSA-97cp-8873-v2gf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-97cp-8873-v2gf
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-97cp-8873-v2gf
reference_id GHSA-97cp-8873-v2gf
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/security/advisories/GHSA-97cp-8873-v2gf
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.18
purl pkg:composer/pimcore/pimcore@10.5.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-13m1-u59p-eue5
1
vulnerability VCID-1hqj-r197-dyfe
2
vulnerability VCID-354d-zv99-73g6
3
vulnerability VCID-3et6-gmgj-h7bn
4
vulnerability VCID-3ref-crmy-eucd
5
vulnerability VCID-4dk6-cfer-t7b5
6
vulnerability VCID-5qj5-vh6d-7khq
7
vulnerability VCID-5tz5-h4wq-3qfy
8
vulnerability VCID-68hd-e927-4kcu
9
vulnerability VCID-6w41-7cfk-j7cn
10
vulnerability VCID-81mh-qb4b-n7a8
11
vulnerability VCID-93rb-sj45-w3fh
12
vulnerability VCID-979q-g8dh-1fgw
13
vulnerability VCID-9ra4-dac9-7qba
14
vulnerability VCID-bb65-xxsn-m3gv
15
vulnerability VCID-c2j7-ywhr-3ff3
16
vulnerability VCID-c5af-wpgt-dkep
17
vulnerability VCID-cbx2-f95n-kqgd
18
vulnerability VCID-cgzf-jppn-q7ff
19
vulnerability VCID-d7zd-p4g6-ryd1
20
vulnerability VCID-de3u-8wqt-uyc2
21
vulnerability VCID-dhdb-wakw-pufe
22
vulnerability VCID-drty-cbue-3kcv
23
vulnerability VCID-e11t-ywn5-v7gp
24
vulnerability VCID-f4vw-12f3-wfgb
25
vulnerability VCID-f5cg-bkw2-hqct
26
vulnerability VCID-f7yk-9pys-t7dr
27
vulnerability VCID-gs48-295u-mqdt
28
vulnerability VCID-hed9-c39j-87g2
29
vulnerability VCID-j9qv-7wsq-mkf6
30
vulnerability VCID-jgxx-v2wj-zkfh
31
vulnerability VCID-jxr2-qjbz-17ha
32
vulnerability VCID-m9aa-5k15-dfap
33
vulnerability VCID-mapb-drtt-rbez
34
vulnerability VCID-mcrd-q5wz-d7dk
35
vulnerability VCID-mwu6-2hxd-efc2
36
vulnerability VCID-n6h3-gsty-sua2
37
vulnerability VCID-p7w5-8ynh-xuh4
38
vulnerability VCID-q7xb-xff7-77cf
39
vulnerability VCID-qn3n-hpd2-7baf
40
vulnerability VCID-qv8v-b5t4-jqb9
41
vulnerability VCID-t6ek-fzh4-mbdu
42
vulnerability VCID-tkcj-gar9-dbbh
43
vulnerability VCID-uaf3-v6zj-uuc3
44
vulnerability VCID-uxdh-6r6k-h7fr
45
vulnerability VCID-v6d4-h4sz-4yad
46
vulnerability VCID-wdud-ckq4-wqfa
47
vulnerability VCID-wzbf-bazj-4kgy
48
vulnerability VCID-xfwh-3838-j7ct
49
vulnerability VCID-xgwg-8q8s-cbfk
50
vulnerability VCID-y92e-mb7u-sueg
51
vulnerability VCID-ycet-r6tz-yyhn
52
vulnerability VCID-zbp5-8ec3-gfe4
53
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.18
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-1115, GHSA-97cp-8873-v2gf
risk_score 3.4
exploitability 0.5
weighted_severity 6.8
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-jx3r-bxmm-hfaw
3
url VCID-ur7d-jx1z-kbet
vulnerability_id VCID-ur7d-jx1z-kbet
summary Relative Path Traversal in pimcore/pimcore.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-30855
reference_id
reference_type
scores
0
value 6e-05
scoring_system epss
scoring_elements 0.00431
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-30855
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch
3
reference_url https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e.patch
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T15:07:33Z/
url https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e.patch
4
reference_url https://github.com/pimcore/pimcore/pull/14498
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
2
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T15:07:33Z/
url https://github.com/pimcore/pimcore/pull/14498
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-30855
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-30855
6
reference_url https://github.com/advisories/GHSA-g2mc-fqqc-hxg3
reference_id GHSA-g2mc-fqqc-hxg3
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-g2mc-fqqc-hxg3
7
reference_url https://github.com/pimcore/pimcore/security/advisories/GHSA-g2mc-fqqc-hxg3
reference_id GHSA-g2mc-fqqc-hxg3
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
1
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-01-29T15:07:33Z/
url https://github.com/pimcore/pimcore/security/advisories/GHSA-g2mc-fqqc-hxg3
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.18
purl pkg:composer/pimcore/pimcore@10.5.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-13m1-u59p-eue5
1
vulnerability VCID-1hqj-r197-dyfe
2
vulnerability VCID-354d-zv99-73g6
3
vulnerability VCID-3et6-gmgj-h7bn
4
vulnerability VCID-3ref-crmy-eucd
5
vulnerability VCID-4dk6-cfer-t7b5
6
vulnerability VCID-5qj5-vh6d-7khq
7
vulnerability VCID-5tz5-h4wq-3qfy
8
vulnerability VCID-68hd-e927-4kcu
9
vulnerability VCID-6w41-7cfk-j7cn
10
vulnerability VCID-81mh-qb4b-n7a8
11
vulnerability VCID-93rb-sj45-w3fh
12
vulnerability VCID-979q-g8dh-1fgw
13
vulnerability VCID-9ra4-dac9-7qba
14
vulnerability VCID-bb65-xxsn-m3gv
15
vulnerability VCID-c2j7-ywhr-3ff3
16
vulnerability VCID-c5af-wpgt-dkep
17
vulnerability VCID-cbx2-f95n-kqgd
18
vulnerability VCID-cgzf-jppn-q7ff
19
vulnerability VCID-d7zd-p4g6-ryd1
20
vulnerability VCID-de3u-8wqt-uyc2
21
vulnerability VCID-dhdb-wakw-pufe
22
vulnerability VCID-drty-cbue-3kcv
23
vulnerability VCID-e11t-ywn5-v7gp
24
vulnerability VCID-f4vw-12f3-wfgb
25
vulnerability VCID-f5cg-bkw2-hqct
26
vulnerability VCID-f7yk-9pys-t7dr
27
vulnerability VCID-gs48-295u-mqdt
28
vulnerability VCID-hed9-c39j-87g2
29
vulnerability VCID-j9qv-7wsq-mkf6
30
vulnerability VCID-jgxx-v2wj-zkfh
31
vulnerability VCID-jxr2-qjbz-17ha
32
vulnerability VCID-m9aa-5k15-dfap
33
vulnerability VCID-mapb-drtt-rbez
34
vulnerability VCID-mcrd-q5wz-d7dk
35
vulnerability VCID-mwu6-2hxd-efc2
36
vulnerability VCID-n6h3-gsty-sua2
37
vulnerability VCID-p7w5-8ynh-xuh4
38
vulnerability VCID-q7xb-xff7-77cf
39
vulnerability VCID-qn3n-hpd2-7baf
40
vulnerability VCID-qv8v-b5t4-jqb9
41
vulnerability VCID-t6ek-fzh4-mbdu
42
vulnerability VCID-tkcj-gar9-dbbh
43
vulnerability VCID-uaf3-v6zj-uuc3
44
vulnerability VCID-uxdh-6r6k-h7fr
45
vulnerability VCID-v6d4-h4sz-4yad
46
vulnerability VCID-wdud-ckq4-wqfa
47
vulnerability VCID-wzbf-bazj-4kgy
48
vulnerability VCID-xfwh-3838-j7ct
49
vulnerability VCID-xgwg-8q8s-cbfk
50
vulnerability VCID-y92e-mb7u-sueg
51
vulnerability VCID-ycet-r6tz-yyhn
52
vulnerability VCID-zbp5-8ec3-gfe4
53
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.18
aliases CVE-2023-30855, GHSA-g2mc-fqqc-hxg3
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ur7d-jx1z-kbet
4
url VCID-yah4-88g3-37ak
vulnerability_id VCID-yah4-88g3-37ak
summary 
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-1067
reference_id
reference_type
scores
0
value 0.00017
scoring_system epss
scoring_elements 0.04721
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-1067
1
reference_url https://github.com/pimcore/pimcore
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/pimcore/pimcore
2
reference_url https://github.com/pimcore/pimcore/commit/4b5733266d7d6aeb4f221a15e005db83fc198edf
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-10T19:54:41Z/
url https://github.com/pimcore/pimcore/commit/4b5733266d7d6aeb4f221a15e005db83fc198edf
3
reference_url https://huntr.dev/bounties/31d17b34-f80d-49f2-86e7-97ae715cc045
reference_id
reference_type
scores
0
value 5.2
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
1
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-10T19:54:41Z/
url https://huntr.dev/bounties/31d17b34-f80d-49f2-86e7-97ae715cc045
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-1067
reference_id CVE-2023-1067
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-1067
5
reference_url https://github.com/advisories/GHSA-f2jh-mf2c-8278
reference_id GHSA-f2jh-mf2c-8278
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-f2jh-mf2c-8278
fixed_packages
0
url pkg:composer/pimcore/pimcore@10.5.18
purl pkg:composer/pimcore/pimcore@10.5.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-13m1-u59p-eue5
1
vulnerability VCID-1hqj-r197-dyfe
2
vulnerability VCID-354d-zv99-73g6
3
vulnerability VCID-3et6-gmgj-h7bn
4
vulnerability VCID-3ref-crmy-eucd
5
vulnerability VCID-4dk6-cfer-t7b5
6
vulnerability VCID-5qj5-vh6d-7khq
7
vulnerability VCID-5tz5-h4wq-3qfy
8
vulnerability VCID-68hd-e927-4kcu
9
vulnerability VCID-6w41-7cfk-j7cn
10
vulnerability VCID-81mh-qb4b-n7a8
11
vulnerability VCID-93rb-sj45-w3fh
12
vulnerability VCID-979q-g8dh-1fgw
13
vulnerability VCID-9ra4-dac9-7qba
14
vulnerability VCID-bb65-xxsn-m3gv
15
vulnerability VCID-c2j7-ywhr-3ff3
16
vulnerability VCID-c5af-wpgt-dkep
17
vulnerability VCID-cbx2-f95n-kqgd
18
vulnerability VCID-cgzf-jppn-q7ff
19
vulnerability VCID-d7zd-p4g6-ryd1
20
vulnerability VCID-de3u-8wqt-uyc2
21
vulnerability VCID-dhdb-wakw-pufe
22
vulnerability VCID-drty-cbue-3kcv
23
vulnerability VCID-e11t-ywn5-v7gp
24
vulnerability VCID-f4vw-12f3-wfgb
25
vulnerability VCID-f5cg-bkw2-hqct
26
vulnerability VCID-f7yk-9pys-t7dr
27
vulnerability VCID-gs48-295u-mqdt
28
vulnerability VCID-hed9-c39j-87g2
29
vulnerability VCID-j9qv-7wsq-mkf6
30
vulnerability VCID-jgxx-v2wj-zkfh
31
vulnerability VCID-jxr2-qjbz-17ha
32
vulnerability VCID-m9aa-5k15-dfap
33
vulnerability VCID-mapb-drtt-rbez
34
vulnerability VCID-mcrd-q5wz-d7dk
35
vulnerability VCID-mwu6-2hxd-efc2
36
vulnerability VCID-n6h3-gsty-sua2
37
vulnerability VCID-p7w5-8ynh-xuh4
38
vulnerability VCID-q7xb-xff7-77cf
39
vulnerability VCID-qn3n-hpd2-7baf
40
vulnerability VCID-qv8v-b5t4-jqb9
41
vulnerability VCID-t6ek-fzh4-mbdu
42
vulnerability VCID-tkcj-gar9-dbbh
43
vulnerability VCID-uaf3-v6zj-uuc3
44
vulnerability VCID-uxdh-6r6k-h7fr
45
vulnerability VCID-v6d4-h4sz-4yad
46
vulnerability VCID-wdud-ckq4-wqfa
47
vulnerability VCID-wzbf-bazj-4kgy
48
vulnerability VCID-xfwh-3838-j7ct
49
vulnerability VCID-xgwg-8q8s-cbfk
50
vulnerability VCID-y92e-mb7u-sueg
51
vulnerability VCID-ycet-r6tz-yyhn
52
vulnerability VCID-zbp5-8ec3-gfe4
53
vulnerability VCID-zth5-afz8-uya7
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.18
1
url pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
purl pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-68hd-e927-4kcu
1
vulnerability VCID-81mh-qb4b-n7a8
2
vulnerability VCID-bb65-xxsn-m3gv
3
vulnerability VCID-dhdb-wakw-pufe
4
vulnerability VCID-f4vw-12f3-wfgb
5
vulnerability VCID-f5cg-bkw2-hqct
6
vulnerability VCID-pvmk-ymnm-uyah
7
vulnerability VCID-uaf3-v6zj-uuc3
8
vulnerability VCID-xfwh-3838-j7ct
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@11.0.0-ALPHA1
aliases CVE-2023-1067, GHSA-f2jh-mf2c-8278
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-yah4-88g3-37ak
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/pimcore/pimcore@10.5.18