Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 146

Export CSV
CVE-2023-0827

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.

CVSS 3.1 · 5.4 Medium EPSS 3.0% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1115

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-23937

Missing file upload type validation in pimcore/pimcore

Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain. This issue has been patched in version 10.5.16.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1067

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1116

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1117

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1286

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1312

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-5873

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1429

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1515

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1517

Cross-site Scripting (XSS) - DOM in pimcore/pimcore

Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1578

SQL Injection in pimcore/pimcore

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 8.8 High EPSS 62.8% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-28106

Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-28108

Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-28429

Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field

Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-28438

Pimcore vulnerable to improper quoting of filters in Custom Reports

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1703

Cross-site Scripting (XSS) - Generic in pimcore/pimcore

Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1704

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1701

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore