Vulnerabilidades en pimcore

149 resultados
Análisis Vexday

Com 132 CVEs catalogadas e nenhuma registrada no catálogo de exploração ativa da CISA KEV, o Pimcore apresenta taxa de exploração abaixo da média geral do catálogo. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que tende a predominar em plataformas com interfaces web extensas e edição de conteúdo. Apesar da ausência de exploração confirmada, o CVE-2022-0832 merece atenção prioritária: seu score EPSS de 0,6662 indica probabilidade elevada de exploração em comparação com a base geral de vulnerabilidades, o que sugere que agentes de ameaça têm interesse técnico na falha mesmo sem registro formal de uso ativo. O surgimento de 2 novas CVEs nos últimos 90 dias indica manutenção contínua de superfície de ataque, e equipes responsáveis por instâncias do Pimcore devem monitorar atualizações de patch com regularidade.

CVE-2022-0894HIGHCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.7%CVE-2024-25625HIGHPimcore Host Header Injection in user invitation linkEPSS 0.7%CVE-2023-2336MEDIUMPath Traversal in pimcore/pimcoreEPSS 0.7%CVE-2026-55207HIGHPimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypassEPSS 0.7%CVE-2022-0260MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.7%CVE-2023-47636MEDIUMFull Path Disclosure via re-export document in pimcore/admin-ui-classic-bundleEPSS 0.7%CVE-2023-3819HIGHExposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcoreEPSS 0.7%CVE-2022-0256MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.6%CVE-2023-38708MEDIUMPimcore Path Traversal Vulnerability in AssetController:importServerFilesActionEPSS 0.6%CVE-2026-45260HIGHPimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handlingEPSS 0.6%CVE-2022-0510MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.6%CVE-2022-0348MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.6%CVE-2023-4145MEDIUMCross-site Scripting (XSS) - Stored in pimcore/customer-data-frameworkEPSS 0.6%CVE-2026-55416HIGHPimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without ParameterizationEPSS 0.6%CVE-2024-21667MEDIUMPimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extractsEPSS 0.6%CVE-2022-0955MEDIUMCross-site Scripting (XSS) - Stored in pimcore/data-hubEPSS 0.6%CVE-2023-4453MEDIUMCross-site Scripting (XSS) - Reflected in pimcore/pimcoreEPSS 0.6%CVE-2023-37280MEDIUMPimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup pageEPSS 0.6%CVE-2023-2630MEDIUMCross-site Scripting (XSS) - Stored in pimcore/pimcoreEPSS 0.6%CVE-2023-28850MEDIUMPimcore Perspective Editor vulnerable to Cross-site Scripting in perspective nameEPSS 0.6%