pimcore records

155 published records for vendor pimcore.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 2 · 1.3%
Pre-auth RCE: 6
With a fix record: 95.5%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

155 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
56Plan	CVE-2019-10867Weaponized	An issue was discovered in Pimcore before 5.7.1.pimcore · pimcore · CWE-502 Deserialization	High8.8	—	68.9%	Apr 4, 2019
54Plan	CVE-2023-1578No exploit	SQL Injection in pimcore/pimcorepimcore · pimcore · CWE-89 SQL injection	High8.8	—	62.8%	Mar 22, 2023
49Plan	CVE-2022-1429No exploit	SQL injection in GridHelperService.php in pimcore/pimcorepimcore · pimcore · CWE-89 Pre-auth SQL injection	High7.5	—	63.9%	Apr 22, 2022
41Plan	CVE-2022-0832No exploit	Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore · pimcore · CWE-79 XSS	Medium5.4	—	66.6%	Mar 4, 2022
40Plan	CVE-2022-39365No exploit	RCE vulnerability in Pimcore/Mail & Dynamic Text Layoutpimcore · pimcore · CWE-94 pre-auth RCE SSTI	Critical9.8	—	1.8%	Oct 27, 2022
39Monitor	CVE-2019-18985No exploit	Pimcore before 6.2.2 lacks brute force protection for the 2FA token.pimcore · pimcore · CWE-307 Pre-auth	Critical9.8	—	1.4%	Nov 15, 2019
39Monitor	CVE-2019-18981No exploit	Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.pimcore · pimcore · CWE-838 Pre-auth	Critical9.8	—	1.4%	Nov 15, 2019
37Monitor	CVE-2024-25625No exploit	Pimcore Host Header Injection in user invitation linkpimcore · admin classic bundle · CWE-74 Pre-auth	Critical9.3	—	0.7%	Feb 19, 2024
36Monitor	CVE-2018-14057Proof of concept	Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-pimcore · pimcore · CWE-352 Pre-auth CSRF	High8.8	—	3.3%	Aug 17, 2018
36Monitor	CVE-2021-23405No exploit	This affects the package pimcore/pimcore before 10.0.7.pimcore · pimcore · CWE-89 SQL injection	High8.8	—	1.7%	Jul 9, 2021
36Monitor	CVE-2019-16317No exploit	In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameterpimcore · pimcore · CWE-502 Deserialization	High8.8	—	1.7%	Sep 14, 2019
36Monitor	CVE-2021-4139No exploit	Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore · pimcore · CWE-79 XSS	Critical9.0	—	0.9%	Dec 21, 2021
36Monitor	CVE-2024-24822No exploit	Pimcore Admin Classic Bundle permissions are not getting checked when working with tagspimcore · admin classic bundle · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Feb 7, 2024
35Monitor	CVE-2018-14058Weaponized	Pimcore before 5.3.0 allows SQL Injection via the REST web service API.pimcore · pimcore · CWE-89 SQL injection	Medium6.5	—	29.0%	Aug 17, 2018
35Monitor	CVE-2022-0258No exploit	SQL Injection in pimcore/pimcorepimcore · pimcore · CWE-89 SQL injection	High8.8	—	1.7%	Jan 17, 2022
35Monitor	CVE-2019-16318No exploit	In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstpimcore · pimcore · CWE-434 File upload	High8.8	—	1.4%	Sep 14, 2019
35Monitor	CVE-2023-47637No exploit	SQL Injection in Admin Grid Filter API in Pimcorepimcore · pimcore · CWE-89 RCE SQL injection	High8.8	—	1.2%	Nov 15, 2023
35Monitor	CVE-2021-37702No exploit	Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcorepimcore · pimcore · CWE-1236	High8.8	—	1.1%	Aug 18, 2021
35Monitor	CVE-2024-23646No exploit	Pimcore Admin Classic Bundle SQL Injection in Admin download files as zippimcore · admin classic bundle · CWE-89 RCE SQL injection	High8.8	—	1.0%	Jan 24, 2024
35Monitor	CVE-2023-25240No exploit	An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.pimcore · pimcore · CWE-1265 pre-auth RCE	High8.8	—	1.0%	Feb 13, 2023
35Monitor	CVE-2023-2983No exploit	Privilege Defined With Unsafe Actions in pimcore/pimcorepimcore · pimcore · CWE-267	High8.8	—	0.9%	May 30, 2023
35Monitor	CVE-2023-2338No exploit	SQL Injection in pimcore/pimcorepimcore · pimcore · CWE-89 SQL injection	High8.8	—	0.9%	Apr 27, 2023
35Monitor	CVE-2023-2984No exploit	Path Traversal: '\..\filename' in pimcore/pimcorepimcore · pimcore · CWE-29 Path traversal	High8.8	—	0.9%	May 30, 2023
35Monitor	CVE-2024-23648No exploit	Pimcore Admin Classic Bundle host header injection in the password resetpimcore · admin classic bundle · CWE-74 Pre-auth	High8.8	—	0.8%	Jan 24, 2024
35Monitor	CVE-2023-30850No exploit	Pimcore SQL Injection Vulnerability in Admin Translations APIpimcore · pimcore · CWE-89 SQL injection	High8.8	—	0.8%	Apr 27, 2023

CVE-2019-10867
56Plan
An issue was discovered in Pimcore before 5.7.1.
HighCVSS 8.8WeaponizedEPSS 69%
- Deserialization
pimcore · pimcoreApr 4, 2019
CVE-2023-1578
54Plan
SQL Injection in pimcore/pimcore
HighCVSS 8.8No exploitEPSS 63%
- SQL injection
pimcore · pimcoreMar 22, 2023
CVE-2022-1429
49Plan
SQL injection in GridHelperService.php in pimcore/pimcore
HighCVSS 7.5No exploitEPSS 64%
- Pre-auth
- SQL injection
pimcore · pimcoreApr 22, 2022
CVE-2022-0832
41Plan
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
MediumCVSS 5.4No exploitEPSS 67%
- XSS
pimcore · pimcoreMar 4, 2022
CVE-2022-39365
40Plan
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- SSTI
pimcore · pimcoreOct 27, 2022
CVE-2019-18985
39Monitor
Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
pimcore · pimcoreNov 15, 2019
CVE-2019-18981
39Monitor
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
pimcore · pimcoreNov 15, 2019
CVE-2024-25625
37Monitor
Pimcore Host Header Injection in user invitation link
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
pimcore · admin classic bundleFeb 19, 2024
CVE-2018-14057
36Monitor
Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the X-pimcore-
HighCVSS 8.8Proof of conceptEPSS 3%
- Pre-auth
- CSRF
pimcore · pimcoreAug 17, 2018
CVE-2021-23405
36Monitor
This affects the package pimcore/pimcore before 10.0.7.
HighCVSS 8.8No exploitEPSS 2%
- SQL injection
pimcore · pimcoreJul 9, 2021
CVE-2019-16317
36Monitor
In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter
HighCVSS 8.8No exploitEPSS 2%
- Deserialization
pimcore · pimcoreSep 14, 2019
CVE-2021-4139
36Monitor
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
CriticalCVSS 9.0No exploitEPSS 1%
- XSS
pimcore · pimcoreDec 21, 2021
CVE-2024-24822
36Monitor
Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
- Broken access control (IDOR)
pimcore · admin classic bundleFeb 7, 2024
CVE-2018-14058
35Monitor
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
MediumCVSS 6.5WeaponizedEPSS 29%
- SQL injection
pimcore · pimcoreAug 17, 2018
CVE-2022-0258
35Monitor
SQL Injection in pimcore/pimcore
HighCVSS 8.8No exploitEPSS 2%
- SQL injection
pimcore · pimcoreJan 17, 2022
CVE-2019-16318
35Monitor
In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonst
HighCVSS 8.8No exploitEPSS 1%
- File upload
pimcore · pimcoreSep 14, 2019
CVE-2023-47637
35Monitor
SQL Injection in Admin Grid Filter API in Pimcore
HighCVSS 8.8No exploitEPSS 1%
- RCE
- SQL injection
pimcore · pimcoreNov 15, 2023
CVE-2021-37702
35Monitor
Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore
HighCVSS 8.8No exploitEPSS 1%
pimcore · pimcoreAug 18, 2021
CVE-2024-23646
35Monitor
Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
HighCVSS 8.8No exploitEPSS 1%
- RCE
- SQL injection
pimcore · admin classic bundleJan 24, 2024
CVE-2023-25240
35Monitor
An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
HighCVSS 8.8No exploitEPSS 1%
- pre-auth RCE
pimcore · pimcoreFeb 13, 2023
CVE-2023-2983
35Monitor
Privilege Defined With Unsafe Actions in pimcore/pimcore
HighCVSS 8.8No exploitEPSS 1%
pimcore · pimcoreMay 30, 2023
CVE-2023-2338
35Monitor
SQL Injection in pimcore/pimcore
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
pimcore · pimcoreApr 27, 2023
CVE-2023-2984
35Monitor
Path Traversal: '\..\filename' in pimcore/pimcore
HighCVSS 8.8No exploitEPSS 1%
- Path traversal
pimcore · pimcoreMay 30, 2023
CVE-2024-23648
35Monitor
Pimcore Admin Classic Bundle host header injection in the password reset
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
pimcore · admin classic bundleJan 24, 2024
CVE-2023-30850
35Monitor
Pimcore SQL Injection Vulnerability in Admin Translations API
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
pimcore · pimcoreApr 27, 2023