pimcore vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 202110
3. 202231
4. 202369
5. 202412
6. 20254
7. 202623

Newest CVEs

• CVE-2026-109392

  Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview

  Pimcore · Pimcore

  Medium5.1
• CVE-2026-55416

  Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization

  pimcore · pimcore

  High8.8
• CVE-2026-55072

  Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

  pimcore · pimcore

  High8.5
• CVE-2026-55634

  Pimcore: Remote Code Execution via DataObject Class-Definition Field Name

  pimcore · pimcore

  Critical9.9
• CVE-2026-55220

  Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column

  pimcore · pimcore

  Critical9.3
• CVE-2026-44741

  Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

  pimcore · pimcore

  High8.8
• CVE-2026-72562

  Pimcore pimcore admin-ui-classic-bundle - SQL Injection

  Pimcore · pimcore admin-ui-classic-bundle

  High8.8
• CVE-2026-45704

  Pimcore: CustomReports Share Bypass

  pimcore · pimcore

  High7.1
• CVE-2026-44739

  Pimcore: SQL Injection in Custom Reports Column Configuration

  pimcore · pimcore

  High8.7
• CVE-2026-45260

  Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

  pimcore · pimcore

  High8.1