| CVE-2022-0348 | MEDIO5.4 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2. | 27/01/2022 |
| CVE-2022-0251 | MEDIO5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10. | 26/01/2022 |
| CVE-2022-0285 | MEDIO5.4 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9. | 20/01/2022 |
| CVE-2022-0263 | ALTO7.8 | Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7. | 18/01/2022 |
| CVE-2022-0262 | MEDIO6.1 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7. | 18/01/2022 |
| CVE-2021-4146 | MEDIO4.3 | Business Logic Errors in GitHub repository pimcore/pimcore prior to 10.2.6. | 18/01/2022 |
| CVE-2022-0260 | MEDIO5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7. | 18/01/2022 |
| CVE-2022-0258 | ALTO8.8 | pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command | 17/01/2022 |
| CVE-2022-0257 | MEDIO5.4 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 17/01/2022 |
| CVE-2022-0256 | MEDIO5.4 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 17/01/2022 |
| CVE-2021-4139 | CRÍTICO9.0 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 21/12/2021 |
| CVE-2021-4084 | MEDIO6.1 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 10/12/2021 |
| CVE-2021-4082 | MEDIO4.3 | pimcore is vulnerable to Cross-Site Request Forgery (CSRF) | 10/12/2021 |
| CVE-2021-4081 | MEDIO6.1 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 10/12/2021 |
| CVE-2021-39189 | MEDIO5.3 | Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually. | 15/09/2021 |
| CVE-2021-39170 | MEDIO5.4 | Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually. | 01/09/2021 |
| CVE-2021-39166 | MEDIO5.4 | Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2. | 01/09/2021 |
| GHSA-cfcv-q4qq-2ph4 | MEDIO | CKEditor 4 vulnerabilities in versions <4.16.1 | 23/08/2021 |
| CVE-2021-37702 | ALTO8.8 | Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround. | 18/08/2021 |
| CVE-2021-23405 | ALTO8.8 | This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class. | 09/07/2021 |