| 0 |
| url |
VCID-35c5-mzwz-8bgw |
| vulnerability_id |
VCID-35c5-mzwz-8bgw |
| summary |
Withdrawn Advisory: Pimcore vulnerable to Cross-site Scripting
## Withdrawn Advisory
This advisory has been withdrawn because the maintainers no longer consider this to be a security issue. This link is maintained to preserve external references.
## Original Description
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 11.0.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-1247, GHSA-8wg7-88cg-7p9j
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-35c5-mzwz-8bgw |
|
| 1 |
| url |
VCID-6uw7-89nn-tkg3 |
| vulnerability_id |
VCID-6uw7-89nn-tkg3 |
| summary |
Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of `getFilterCondition()` is in `Multiselect`, which does not normalize/escape/validate the passed value. Any backend user with very basic permissions can execute arbitrary SQL statements and thus alter any data or escalate their privileges to at least admin level. This vulnerability has been addressed in version 11.1.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2023-47637, GHSA-72hh-xf79-429p
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6uw7-89nn-tkg3 |
|
| 2 |
|
| 3 |
| url |
VCID-cbz2-sxrt-rffn |
| vulnerability_id |
VCID-cbz2-sxrt-rffn |
| summary |
Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend. This vulnerability is fixed in 12.3.1 and 11.5.14. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-23493, GHSA-q433-j342-rp9h
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cbz2-sxrt-rffn |
|
| 4 |
| url |
VCID-em5a-b39y-6qgc |
| vulnerability_id |
VCID-em5a-b39y-6qgc |
| summary |
Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, the filter query parameter in the dependency listing endpoints is JSON-decoded and the value field is concatenated directly into RLIKE clauses without sanitization or parameterized queries. Exploiting this issue requires admin authentication. An attacker with admin panel access can extract the full database including password hashes of other admin users. Version 12.3.3 contains a patch. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-27461 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02341 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02334 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.0234 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00013 |
| scoring_system |
epss |
| scoring_elements |
0.02342 |
| published_at |
2026-06-11T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-27461 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-27461, GHSA-vxg3-v4p6-f3fp
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-em5a-b39y-6qgc |
|
| 5 |
| url |
VCID-ha34-7pm3-pqgm |
| vulnerability_id |
VCID-ha34-7pm3-pqgm |
| summary |
Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injection patch in the Admin Search Find API allows an authenticated attacker to perform blind SQL injection. Although CVE-2023-30848 attempted to mitigate SQL injection by removing SQL comments (--) and catching syntax errors, the fix is insufficient. Attackers can still inject SQL payloads that do not rely on comments and infer database information via blind techniques. This vulnerability affects the admin interface and can lead to database information disclosure. This vulnerability is fixed in 12.3.1 and 11.5.14. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-23492, GHSA-qvr7-7g55-69xj
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ha34-7pm3-pqgm |
|
| 6 |
| url |
VCID-p5rs-jqqj-dudg |
| vulnerability_id |
VCID-p5rs-jqqj-dudg |
| summary |
Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2025-27617 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00544 |
| scoring_system |
epss |
| scoring_elements |
0.68286 |
| published_at |
2026-06-12T12:55:00Z |
|
| 1 |
| value |
0.00544 |
| scoring_system |
epss |
| scoring_elements |
0.68296 |
| published_at |
2026-06-14T12:55:00Z |
|
| 2 |
| value |
0.00544 |
| scoring_system |
epss |
| scoring_elements |
0.68197 |
| published_at |
2026-06-11T12:55:00Z |
|
| 3 |
| value |
0.00544 |
| scoring_system |
epss |
| scoring_elements |
0.68298 |
| published_at |
2026-06-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2025-27617 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2025-27617, GHSA-qjpx-5m2p-5pgh
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p5rs-jqqj-dudg |
|
| 7 |
|
| 8 |
| url |
VCID-vgqm-xjtk-yffe |
| vulnerability_id |
VCID-vgqm-xjtk-yffe |
| summary |
Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for reading or listing static routes. In Pimcore, static routes are custom URL patterns defined via the backend interface or the var/config/staticroutes.php file, including details like regex-based patterns, controllers, variables, and priorities. These routes are registered automatically through the PimcoreStaticRoutesBundle and integrated into the MVC routing system. Testing revealed that an authenticated backend user lacking explicit permissions was able to invoke the endpoint (e.g., GET /api/static-routes) and retrieve sensitive route configurations. This vulnerability is fixed in 12.3.1 and 11.5.14. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-23494, GHSA-m3r2-724c-pwgf
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vgqm-xjtk-yffe |
|