| CVE-2021-4082 | TRUNG BÌNH4.3 | pimcore is vulnerable to Cross-Site Request Forgery (CSRF) | 10/12/2021 |
| CVE-2021-4081 | TRUNG BÌNH6.1 | pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 10/12/2021 |
| CVE-2021-39189 | TRUNG BÌNH5.3 | Pimcore is an open source data & experience management platform. In versions prior to 10.1.3, it is possible to enumerate usernames via the forgot password functionality. This issue is fixed in version 10.1.3. As a workaround, one may apply the available patch manually. | 15/09/2021 |
| CVE-2021-39170 | TRUNG BÌNH5.4 | Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround, users may apply the patch manually. | 01/09/2021 |
| CVE-2021-39166 | TRUNG BÌNH5.4 | Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2. | 01/09/2021 |
| CVE-2021-37702 | CAO8.8 | Pimcore is an open source data & experience management platform. Prior to version 10.1.1, Data Object CSV import allows formular injection. The problem is patched in 10.1.1. Aside from upgrading, one may apply the patch manually as a workaround. | 18/08/2021 |
| CVE-2021-31869 | CAO7.5 | Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This issue was fixed in version 6.9.4 of the product. | 04/08/2021 |
| CVE-2021-23405 | CAO8.8 | This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class. | 09/07/2021 |
| CVE-2021-23340 | CAO7.1 | This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following | 18/02/2021 |
| CVE-2020-26246 | TRUNG BÌNH6.5 | Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions. | 03/12/2020 |
| CVE-2020-7759 | CAO7.2 | The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.ex | 30/10/2020 |
| CVE-2019-10763 | TRUNG BÌNH6.5 | pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error b | 18/11/2019 |
| CVE-2019-18986 | CAO7.5 | Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users. | 15/11/2019 |
| CVE-2019-18985 | NGHIÊM TRỌNG9.8 | Pimcore before 6.2.2 lacks brute force protection for the 2FA token. | 15/11/2019 |
| CVE-2019-18982 | TRUNG BÌNH6.1 | bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header. | 15/11/2019 |
| CVE-2019-18981 | NGHIÊM TRỌNG9.8 | Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification. | 15/11/2019 |
| CVE-2019-18656 | TRUNG BÌNH6.1 | Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements. | 31/10/2019 |
| CVE-2019-16318 | CAO8.8 | In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317. | 14/09/2019 |
| CVE-2019-16317 | CAO8.8 | In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerability than CVE-2019-1 | 14/09/2019 |
| CVE-2019-10867 | CAO8.8 | An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController | 04/04/2019 |