Exposición de Pimcore

CMS, Ecommerce
40
score de exposición
2349
sitios usan
0
en explotación
3
críticos

CVEs

46 resultados
CVE-2026-55220CRITICALPimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store columnEPSS 0.7%CVE-2026-55207HIGHPimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypassEPSS 0.7%CVE-2026-55634CRITICALPimcore: Remote Code Execution via DataObject Class-Definition Field NameEPSS 0.7%CVE-2026-55416HIGHPimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without ParameterizationEPSS 0.7%CVE-2023-38708MEDIUMPimcore Path Traversal Vulnerability in AssetController:importServerFilesActionEPSS 0.6%CVE-2026-45260HIGHPimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handlingEPSS 0.6%CVE-2023-28429MEDIUMPimcore has Cross-site Scripting vulnerability in DataObject tooltip fieldEPSS 0.5%CVE-2024-49370HIGHChange-Password via Portal-Profile sets PimcoreBackendUser password without hashingEPSS 0.5%CVE-2026-27461MEDIUMPimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clauseEPSS 0.5%CVE-2026-44741HIGHPimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property ParameterEPSS 0.5%CVE-2025-27617MEDIUMPimcore Vulnerable to SQL Injection in getRelationFilterConditionEPSS 0.5%CVE-2023-23937HIGHMissing file upload type validation in pimcore/pimcoreEPSS 0.5%CVE-2026-23492HIGHPimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848EPSS 0.5%CVE-2026-5394HIGHPimcore Platform v12.3.3 - SQL Injection in DataObject composite index handlingEPSS 0.4%CVE-2026-23493HIGHPimcore ENV Variables and Cookie Informations are exposed in http_error_logEPSS 0.4%CVE-2026-45704HIGHPimcore: CustomReports Share BypassEPSS 0.4%CVE-2026-55208HIGHPimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashesEPSS 0.4%CVE-2026-55072HIGHPimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table nameEPSS 0.4%CVE-2026-44739HIGHPimcore: SQL Injection in Custom Reports Column ConfigurationEPSS 0.4%CVE-2026-23495MEDIUMPimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" ListingEPSS 0.4%