Vulnerabilities in Pimcore
149 resultsCVE-2026-23494MEDIUMPimcore is Missing Function Level Authorization on "Static Routes" ListingEPSS 0.4%CVE-2026-55212HIGHPimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege EscalationEPSS 0.4%CVE-2023-1515MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.3%CVE-2023-5873MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.3%CVE-2026-45703MEDIUMPimcore: WordExport Authorization Bypass for Unauthorized Document ExportEPSS 0.3%CVE-2026-23496MEDIUMPimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level AuthorizationEPSS 0.3%CVE-2026-5362MEDIUMPimcore Platform v12.3.3 - Stored XSS in Document Editable Embed renderingEPSS 0.3%CVE-2023-49076MEDIUMPimcore missing token/header to prevent CSRFEPSS 0.3%CVE-2025-30166LOWPimcore's Admin Classic Bundle allows HTML InjectionEPSS 0.2%