Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hed9-c39j-87g2
Vulnerability ID VCID-hed9-c39j-87g2
Aliases CVE-2023-3820
GHSA-c9hw-557q-f8hq
Summary Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.41187 https://api.first.org/data/v1/epss?cve=CVE-2023-3820
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-c9hw-557q-f8hq
cvssv3.1 7.2 https://github.com/pimcore/pimcore
generic_textual HIGH https://github.com/pimcore/pimcore
cvssv3 7.2 https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
cvssv3.1 7.2 https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
generic_textual HIGH https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
ssvc Track* https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
cvssv3.1 7.2 https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq
cvssv3.1_qr HIGH https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq
generic_textual HIGH https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq
cvssv3 7.2 https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
cvssv3.1 7.2 https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
generic_textual HIGH https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
ssvc Track* https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2023-3820
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-3820
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-3820
https://github.com/pimcore/pimcore
https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq
https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
CVE-2023-3820 https://nvd.nist.gov/vuln/detail/CVE-2023-3820
GHSA-c9hw-557q-f8hq https://github.com/advisories/GHSA-c9hw-557q-f8hq
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pimcore/pimcore
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-16T13:29:49Z/ Found at https://github.com/pimcore/pimcore/commit/e641968979d4a2377bbea5e2a76bdede040d0b97
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/pimcore/pimcore/security/advisories/GHSA-c9hw-557q-f8hq
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2024-10-16T13:29:49Z/ Found at https://huntr.dev/bounties/b00a38b6-d040-494d-bf46-38f46ac1a1db
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-3820
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.97459
EPSS Score 0.41187
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:01:23.166823+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/pimcore/pimcore/CVE-2023-3820.yml 38.6.0