Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 172

Export CSV
CVE-2023-1312

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-5873

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1429

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1515

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1517

Cross-site Scripting (XSS) - DOM in pimcore/pimcore

Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1578

SQL Injection in pimcore/pimcore

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.

CVSS 3.1 · 8.8 High EPSS 62.8% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-28106

Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-28108

Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-28429

Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field

Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-28438

Pimcore vulnerable to improper quoting of filters in Custom Reports

Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1703

Cross-site Scripting (XSS) - Generic in pimcore/pimcore

Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1704

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1701

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-1702

Cross-site Scripting (XSS) - Generic in pimcore/pimcore

Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-28850

Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name

Pimcore Perspective Editor provides an editor for Pimcore that allows users to add/remove/edit custom views and perspectives. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Version 1.5.1 has a patch. As a workaround, one may apply the patch manually.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Perspective Editor
CVE-2023-2338

SQL Injection in pimcore/pimcore

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-2328

Cross-site Scripting (XSS) - Generic in pimcore/pimcore

Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-2336

Path Traversal in pimcore/pimcore

Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-2322

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore
CVE-2023-2323

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pimcore
Products
Pimcore