Known vulnerabilities in Pimcore

Vendor: Pimcore
Software: Pimcore
Software CPE: cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:*
Total vulnerabilities: 92
Public exploits: 8
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Pimcore Pimcore is affected by 92 known vulnerabilities: 10 high, 32 medium, 50 low Critical High Medium Low

Vulnerabilities (92)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134523 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-89 Medium
No
No
11.5.18, 12.3.9, 2026.1.5 15.06.2026 SB2026061537
#VU134522 - Improper Access Control
CVE-2026-45704
CWE-284 Low
No
No
11.5.17 15.06.2026 SB2026061535
#VU134521 - Improper Access Control
CVE-2026-45703
CWE-284 Low
No
No
11.5.17 15.06.2026 SB2026061535
#VU134519 - Deserialization of Untrusted Data
CVE-2026-45162
CWE-502 Low
No
No
11.5.17 15.06.2026 SB2026061535
#VU134518 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-44739
CWE-89 Medium
No
No
11.5.17 15.06.2026 SB2026061535
#VU134517 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-5394
CWE-89 Low
No
No
11.5.17 15.06.2026 SB2026061535
#VU134516 - Missing Authorization
CVE-2026-45260
CWE-862 Medium
No
No
11.5.17 15.06.2026 SB2026061535
#VU127507 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-23492
CWE-89 Medium
Available
No
11.5.14, 12.3.1 24.04.2026 SB2026042488
#VU123173 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-27461
CWE-89 Low
No
No
11.5.15, 12.3.3 24.02.2026 SB2026022441
#VU121624 - Information Exposure Through Log Files
CVE-2026-23493
CWE-532 High
No
No
11.5.14, 12.3.1 16.01.2026 SB20260116107
#VU121623 - Improper Access Control
CVE-2026-23495
CWE-284 Medium
No
No
1.7.16, 2.2.3 16.01.2026 SB20260116106
#VU121622 - Improper Access Control
CVE-2026-23494
CWE-284 Medium
No
No
11.5.14, 12.3.1 16.01.2026 SB20260116107
#VU121620 - Improper Access Control
CVE-2026-23496
CWE-284 Medium
No
No
5.2.2, 6.1.1 16.01.2026 SB20260116105
#VU105960 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-27617
CWE-89 Medium
Available
No
11.5.4 24.03.2025 SB2025032412
#VU103445 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-11956
CWE-89 Low
Available
No
4.2.1 30.01.2025 SB2025013012
#VU103444 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-11954
CWE-79 Low
Available
No
11.5.3 30.01.2025 SB2025013013
#VU96732 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2024-45048
CWE-611 Medium
No
No
10.6.9.12, 11.1.6.11 03.09.2024 SB2024090360
SB20241230139
SB2024090385
#VU91595 - Allocation of Resources Without Limits or Throttling
CVE-2024-32871
CWE-770 Medium
No
No
11.2.4 10.06.2024 SB2024061018
#VU88956 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-29881
CWE-79 Low
No
No
11.2.3 24.04.2024 SB2024042404
SB2024042405
SB2024070924
and 1 more
#VU88955 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-29203
CWE-79 Low
No
No
11.2.3 24.04.2024 SB2024042404
SB2024042405
SB2024070923
and 2 more


Showing elements 1 - 20 out of 92