Is pimcore/pimcore 6.0 vulnerable?

Composer · 6 releases from 6.0.0 to 6.0.5 · latest pimcore/pimcore is 2026.3.3.1 · checked 1 Nov 2026

Yes: 121 known advisories

Yes. pimcore/pimcore 6.0.5, the last 6.0 release, is affected by 121 known security advisories (5 critical, 31 high, 85 medium), including CVE-2026-55634, CVE-2026-55220, CVE-2022-39365. At least one has no fixed release yet.

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting pimcore/pimcore 6.0.5

  • HighCVE-2026-55416GHSA-23rh-xw42-fq8210 Sept 2026

    Pimcore: SQL Injection in Custom Reports via Malicious Report Configuration

    Affected
    >=2026.1.0 <2026.1.6 · >=12.0.0-RC1 <12.3.10 · <11.5.19
    Fixed in
    11.5.19, 12.3.10, 2026.1.6
  • CriticalCVE-2026-55634GHSA-9x44-4gxf-8c2528 Aug 2026

    Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name

    Affected
    <12.3.10 · >=2026.1.0 <2026.1.6
    Fixed in
    12.3.10, 2026.1.6
  • CriticalCVE-2026-55220GHSA-w23p-wrp7-ch3828 Aug 2026

    Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column (PHP Object Injection, CWE-502)

    Affected
    >=2026.1.0 <2026.1.6 · <12.3.10
    Fixed in
    12.3.10, 2026.1.6
  • HighCVE-2026-55072GHSA-2mhj-fhvg-v42813 Aug 2026

    Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

    Affected
    >=2026.1.0 <2026.1.5 · <12.3.9
    Fixed in
    12.3.9, 2026.1.5
  • HighCVE-2026-11407GHSA-7p36-fq2r-4h7r17 Jun 2026

    Pimcore CMS Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed

    Affected
    >=12.0.0-RC1 <=12.3.8 · <=11.5.14.1
    Fixed in
    No fix released
  • HighCVE-2026-5394GHSA-r2f4-ff2p-xc6428 May 2026

    Pimcore Platform - SQL Injection in DataObject composite index handling during class definition import/save

    Affected
    >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
    Fixed in
    11.5.17, 12.3.7, 2026.1.3
  • HighCVE-2026-45704GHSA-jwcc-gv4m-93x627 May 2026

    Pimcore has a CustomReports Share Bypass

    Affected
    >=12.0.0-RC1 <12.3.6 · <11.5.17 · >=2026.1.0 <2026.1.2
    Fixed in
    11.5.17, 12.3.6, 2026.1.2
  • MediumCVE-2026-45703GHSA-332x-r494-54fq27 May 2026

    Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export

    Affected
    >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
    Fixed in
    11.5.17, 12.3.7, 2026.1.3
  • HighCVE-2026-45260GHSA-wc7j-g8wx-m2qx27 May 2026

    Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling

    Affected
    >=12.0.0-RC1 <12.3.7 · >=2026.1.0 <2026.1.3 · <11.5.17
    Fixed in
    11.5.17, 12.3.7, 2026.1.3
  • HighCVE-2026-45162GHSA-36fc-7wjg-mfvj27 May 2026

    Pimcore has Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction

    Affected
    >=12.0.0-RC1 <12.3.7 · <11.5.17 · >=2026.1.0 <2026.1.3
    Fixed in
    11.5.17, 12.3.7, 2026.1.3
  • HighCVE-2026-44739GHSA-3234-gxc3-pq6f27 May 2026

    Pimcore Vulnerable to SQL Injection in Custom Reports Column Configuration

    Affected
    >=2026.1.0 <2026.1.2 · <11.5.17 · >=12.0.0-RC1 <12.3.6
    Fixed in
    11.5.17, 12.3.6, 2026.1.2
  • MediumCVE-2026-27461GHSA-vxg3-v4p6-f3fp24 Feb 2026

    Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause

    Affected
    <=11.5.14.1 · >=12.0.0 <12.3.3
    Fixed in
    12.3.3
  • MediumCVE-2026-23494GHSA-m3r2-724c-pwgf15 Jan 2026

    Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing

    Affected
    >=12.0.0-RC1 <12.3.1 · <11.5.14
    Fixed in
    11.5.14, 12.3.1
  • HighCVE-2026-23493GHSA-q433-j342-rp9h15 Jan 2026

    Pimcore ENV Variables and Cookie Informations are exposed in http_error_log

    Affected
    >=12.0.0-RC1 <12.3.1 · <11.5.14
    Fixed in
    11.5.14, 12.3.1
  • HighCVE-2026-23492GHSA-qvr7-7g55-69xj14 Jan 2026

    Pimcore Has an Incomplete Patch for CVE-2023-30848

    Affected
    >=12.0.0-RC1 <12.3.1 · <11.5.14
    Fixed in
    11.5.14, 12.3.1
  • MediumCVE-2025-27617GHSA-qjpx-5m2p-5pgh11 Mar 2025

    Pimcore Vulnerable to SQL Injection in getRelationFilterCondition

    Affected
    <11.5.4
    Fixed in
    11.5.4
  • HighCVE-2023-47637GHSA-72hh-xf79-429p15 Nov 2023

    Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()

    Affected
    <11.1.1
    Fixed in
    11.1.1
  • MediumCVE-2023-5873GHSA-j59v-hh4p-q92m31 Oct 2023

    Pimcore Cross-site Scripting vulnerability

    Affected
    <11.1.0
    Fixed in
    11.1.0
  • MediumCVE-2023-4453GHSA-599v-h3q5-g6r921 Aug 2023

    Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields

    Affected
    <10.6.8
    Fixed in
    10.6.8
  • MediumCVE-2023-38708GHSA-34hj-v8fm-x8873 Aug 2023

    Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction

    Affected
    <10.6.7
    Fixed in
    10.6.7
  • HighCVE-2023-3819GHSA-r87r-982q-2c3q21 Jul 2023

    Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

    Affected
    <10.6.4
    Fixed in
    10.6.4
  • HighCVE-2023-3820GHSA-c9hw-557q-f8hq21 Jul 2023

    Pimcore vulnerable to SQL Injection in Dataobjects sorting

    Affected
    <10.6.4
    Fixed in
    10.6.4
  • MediumCVE-2023-3821GHSA-78q2-cv3p-x9fm21 Jul 2023

    Pimcore Cross-site Scripting vulnerability

    Affected
    <10.6.4
    Fixed in
    10.6.4
  • MediumCVE-2023-3822GHSA-vmpv-qjhq-r46321 Jul 2023

    Pimcore Cross-site Scripting vulnerability

    Affected
    <10.6.4
    Fixed in
    10.6.4
  • HighCVE-2023-3673GHSA-rxp5-qwrf-pfv314 Jul 2023

    Pimcore SQL Injection vulnerability

    Affected
    <10.5.24
    Fixed in
    10.5.24
  • MediumCVE-2023-2984GHSA-46g3-f9r8-xj4v6 Jun 2023

    Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter

    Affected
    <10.5.22
    Fixed in
    10.5.22
  • MediumCVE-2023-2983GHSA-m4mv-rmr7-h5f56 Jun 2023

    Pimcore Privilege Defined With Unsafe Actions vulnerability

    Affected
    <10.5.23
    Fixed in
    10.5.23
  • MediumCVE-2023-2730GHSA-q3p4-v2cm-q94516 May 2023

    Pimcore Cross-site Scripting vulnerability

    Affected
    <10.3.3
    Fixed in
    10.3.3
  • MediumCVE-2023-2630GHSA-w766-3572-f2hv11 May 2023

    Pimcore Cross-site Scripting (XSS) vulnerability in Admin Translations

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2616GHSA-mhpj-7m7h-8p6x11 May 2023

    Pimcore Cross-site Scripting (XSS) in Static Routes name field

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2614GHSA-m6m9-gr85-79vm10 May 2023

    Pimcore Cross-site Scripting (XSS) in name field of Custom Reports

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2615GHSA-q7cc-m6jw-m26210 May 2023

    Pimcore Cross-site Scripting (XSS) in Predefined Properties delete

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-30855GHSA-g2mc-fqqc-hxg32 May 2023

    Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php

    Affected
    <10.5.18
    Fixed in
    10.5.18
  • MediumCVE-2023-2361GHSA-9xg6-75mh-7x3f1 May 2023

    Cross-site Scripting (XSS) in pimcore

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-30852GHSA-j5c3-r84f-959627 Apr 2023

    Arbitrary File Read in Admin JS CSS files

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2340GHSA-g93x-fm2w-5pxw27 Apr 2023

    Cross-site Scripting (XSS) in DataObject columns grid

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2339GHSA-6fvf-x8c6-2f6j27 Apr 2023

    Cross-site Scripting (XSS) in DataObject Any Getter grid operator

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2336GHSA-hg77-vx9v-f49x27 Apr 2023

    Path Traversal in Asset "import from server" option

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2332GHSA-r7mm-jx6h-hv7m27 Apr 2023

    Cross-site Scripting (XSS) in Conditions tab of Pricing Rules

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2328GHSA-2295-vh28-pphc27 Apr 2023

    Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2327GHSA-x9xj-pqmv-8jf727 Apr 2023

    Cross-site Scripting (XSS) in pimcore via DataObject Class date fields

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2323GHSA-cjv6-w5hf-5wr627 Apr 2023

    Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2322GHSA-476g-v7hf-cw5m27 Apr 2023

    Cross-site Scripting (XSS) in Document Properties Parameter

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • HighCVE-2023-2338GHSA-4x35-vr82-xvj627 Apr 2023

    SQL Injection in AssetController

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2342GHSA-2c67-p4xh-m34w27 Apr 2023

    Cross-site Scripting (XSS) in Website Settings name field

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2341GHSA-fq95-rx4q-qgg227 Apr 2023

    Cross-site Scripting (XSS) in Admin Login too many attempts notice

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-2343GHSA-9q7q-r54q-3f3g27 Apr 2023

    Cross-site Scripting (XSS) in DataObject Classification Store

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • HighCVE-2023-30850GHSA-jwg4-qcgv-5wg627 Apr 2023

    SQL Injection in Admin Translations API

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • HighCVE-2023-30849GHSA-xmg8-w465-mr5627 Apr 2023

    SQL Injection in Translation Export API

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • HighCVE-2023-30848GHSA-6mhm-gcpf-5gr827 Apr 2023

    SQL Injection in Admin Search Find API

    Affected
    <10.5.21
    Fixed in
    10.5.21
  • MediumCVE-2023-1703GHSA-4f25-2x2c-vg6v4 Apr 2023

    pimcore is vulnerable to cross-site scripting in Composite indices key field

    Affected
    <10.5.20
    Fixed in
    10.5.20
  • MediumCVE-2023-1701GHSA-7r35-chv4-xr3r31 Mar 2023

    Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings

    Affected
    <10.5.20
    Fixed in
    10.5.20
  • MediumCVE-2023-1702GHSA-6qjm-39vh-729w31 Mar 2023

    Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings

    Affected
    <10.5.20
    Fixed in
    10.5.20
  • MediumCVE-2023-1704GHSA-hfmg-g39c-544431 Mar 2023

    pimcore is vulnerable to cross-site scripting in translate module

    Affected
    <10.5.20
    Fixed in
    10.5.20
  • MediumCVE-2023-28438GHSA-vf7q-g2pv-jxvx22 Mar 2023

    Pimcore vulnerable to improper quoting of filters in Custom Reports

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1578GHSA-42c3-wvww-gcqj22 Mar 2023

    Pimcore Remote Code Execution vulnerability in Search function

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-28429GHSA-rcg9-hrhx-6q6920 Mar 2023

    Pimcore has Cross-site Scripting vulnerability in DataObject tooltip field

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1515GHSA-66cm-c7ch-5j8q20 Mar 2023

    Pimcore vulnerable to Cross-site Scripting (XSS) in Redirects

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1517GHSA-42x8-2v53-pqmj20 Mar 2023

    Pimcore has Cross site Scripting vulnerability in Schedule tab of Documents

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • HighCVE-2023-28108GHSA-xc9p-r5qj-8xm917 Mar 2023

    Improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-28106GHSA-x5j3-mq9g-8jc817 Mar 2023

    Cross-site Scripting (XSS) in UrlSlug Data type

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumGHSA-2xpm-cmvw-3jcc16 Mar 2023

    Reflected XSS in Application Logger module

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1429GHSA-3223-w774-99fq16 Mar 2023

    Cross-site Scripting (XSS) in Document Types

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumGHSA-rrwm-8wqm-gwgv16 Mar 2023

    Cross-site Scripting (XSS) - stored in Print Documents

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1312GHSA-gh4g-65f6-84g510 Mar 2023

    pimcore is vulnerable to cross-site scripting

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1286GHSA-8jv7-vwrc-mv4g9 Mar 2023

    Cross-site Scripting (XSS) in pimcore/pimcore

    Affected
    <10.5.19
    Fixed in
    10.5.19
  • MediumCVE-2023-1116GHSA-96hp-38wx-j3wc1 Mar 2023

    Pimcore vulnerable to Cross Site Scripting in Email Blacklist

    Affected
    <10.5.18
    Fixed in
    10.5.18
  • MediumCVE-2023-1117GHSA-qxcw-rf4v-hp261 Mar 2023

    Pimcore vulnerable to Cross Site Scripting in image/video thumbnail config

    Affected
    <10.5.18
    Fixed in
    10.5.18
  • MediumCVE-2023-1115GHSA-97cp-8873-v2gf1 Mar 2023

    Pimcore vulnerable to Cross Site Scripting in Documents Link Editable

    Affected
    <10.5.18
    Fixed in
    10.5.18
  • MediumCVE-2023-1067GHSA-f2jh-mf2c-827827 Feb 2023

    Pimcore vulnerable to Cross-site Scripting

    Affected
    <=10.5.17
    Fixed in
    No fix released
  • MediumGHSA-76r7-h46w-463r15 Feb 2023

    Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug

    Affected
    <10.5.17
    Fixed in
    10.5.17
  • HighCVE-2023-25240GHSA-r2vq-p658-p27413 Feb 2023

    SameSite Attribute vulnerability in pimCore

    Affected
    <10.5.16
    Fixed in
    10.5.16
  • MediumCVE-2023-23937GHSA-8xv4-jj4h-qww62 Feb 2023

    Pimcore contains Unrestricted Upload of File with Dangerous Type

    Affected
    <10.5.16
    Fixed in
    10.5.16
  • MediumCVE-2023-0323GHSA-6vf6-g3pr-j83h20 Jan 2023

    pimcore is vulnerable to cross-site scripting via "title field " in data objects

    Affected
    <10.5.14
    Fixed in
    10.5.14
  • CriticalCVE-2022-39365GHSA-5qxq-vgmm-q39m29 Oct 2022

    RCE vulnerability in Pimcore/Mail & Dynamic Text Layout

    Affected
    <10.5.9
    Fixed in
    10.5.9
  • MediumCVE-2022-3255GHSA-wqr6-57qm-hhr522 Sept 2022

    Pimcore vulnerable to cross site scripting

    Affected
    <10.5.7
    Fixed in
    10.5.7
  • MediumCVE-2022-3211GHSA-4849-x3jx-45qr16 Sept 2022

    Pimcore vulnerable to stored stored Cross-site Scripting via`properties` when creating new users

    Affected
    <10.5.6
    Fixed in
    10.5.6
  • MediumCVE-2022-2796GHSA-pr4f-4pcx-2r3h24 Aug 2022

    Pimcore Cross-site Scripting (XSS)

    Affected
    <10.5.4
    Fixed in
    10.5.4
  • HighCVE-2022-31092GHSA-gvmf-wcx6-p97422 Jun 2022

    Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore

    Affected
    <10.4.4
    Fixed in
    10.4.4
  • CriticalCVE-2019-18985GHSA-hf62-5vxh-jpwj24 May 2022

    Pimcore 2FA Vulnerable to Brute Forcing

    Affected
    <6.2.2
    Fixed in
    6.2.2
  • CriticalCVE-2019-18981GHSA-jhcf-j4hg-v64r24 May 2022

    Pimcore Access Control Issues

    Affected
    <6.2.2
    Fixed in
    6.2.2
  • HighCVE-2019-18986GHSA-8889-9g3f-73rj24 May 2022

    Pimcore Discloses Usernames In Use

    Affected
    <6.2.2
    Fixed in
    6.2.2
  • MediumCVE-2019-18982GHSA-m4x3-xmjv-r77824 May 2022

    Pimcore Cross-site Scripting (XSS) vulnerability

    Affected
    <6.3.0
    Fixed in
    6.3.0
  • MediumCVE-2019-18656GHSA-65p8-5423-fw3x24 May 2022

    Pimcore XSS Vulnerability

    Affected
    <6.3.0
    Fixed in
    6.3.0
  • HighCVE-2022-1429GHSA-2v7p-f4qm-r5pc23 Apr 2022

    SQL Injection found in Pimcore

    Affected
    <10.3.6
    Fixed in
    10.3.6
  • MediumCVE-2022-1351GHSA-xcr3-4qvr-54rh15 Apr 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4
    Fixed in
    10.4
  • HighCVE-2022-1339GHSA-mj2c-5mjv-gmmj14 Apr 2022

    SQL Injection in Pimcore

    Affected
    <10.3.5
    Fixed in
    10.3.5
  • HighCVE-2022-1219GHSA-6gm7-j668-w6h99 Apr 2022

    SQL Injection in Pimcore

    Affected
    <10.3.5
    Fixed in
    10.3.5
  • MediumCVE-2022-0911GHSA-j29f-m23h-3p8p17 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4.0
    Fixed in
    10.4.0
  • MediumCVE-2022-0704GHSA-pc32-x737-74cv17 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4.0
    Fixed in
    10.4.0
  • MediumCVE-2022-0705GHSA-xmq3-hgjx-699717 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4.0
    Fixed in
    10.4.0
  • MediumCVE-2022-0894GHSA-22hc-47cc-7x6f16 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4.0
    Fixed in
    10.4.0
  • MediumCVE-2022-0893GHSA-g795-4hxx-qqwm16 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.4.0
    Fixed in
    10.4.0
  • MediumCVE-2022-0832GHSA-6qcc-whgp-pjj25 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.3.3
    Fixed in
    10.3.3
  • MediumCVE-2022-0831GHSA-q67f-3jq4-mww25 Mar 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.3.3
    Fixed in
    10.3.3
  • MediumCVE-2022-0665GHSA-gjq4-69wj-p6pr23 Feb 2022

    Path traversal in pimcore

    Affected
    <10.3.2
    Fixed in
    10.3.2
  • MediumCVE-2022-0565GHSA-h9vc-2p9g-63gp15 Feb 2022

    Cross-site Scripting in pimcore

    Affected
    <10.3.1
    Fixed in
    10.3.1
  • MediumCVE-2022-0509GHSA-cg3h-rc9q-g8v99 Feb 2022

    Cross-site Scripting in pimcore

    Affected
    <10.3.1
    Fixed in
    10.3.1
  • MediumCVE-2022-0510GHSA-mxh3-2699-98g99 Feb 2022

    Cross-site Scripting pimcore

    Affected
    <10.3.1
    Fixed in
    10.3.1
  • MediumCVE-2022-0348GHSA-8x44-pwr2-rgc628 Jan 2022

    Cross-site Scripting in pimcore

    Affected
    <10.2.10
    Fixed in
    10.2.10
  • MediumCVE-2022-0251GHSA-f7q6-xxph-mfm827 Jan 2022

    Cross-site Scripting in Pimcore

    Affected
    <10.2.10
    Fixed in
    10.2.10
  • MediumCVE-2022-0260GHSA-455w-gv5p-wgg326 Jan 2022

    Cross-site Scripting in pimcore

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • MediumCVE-2021-4146GHSA-54hw-mhgh-x4vc26 Jan 2022

    Business Logic Errors in pimcore

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • MediumCVE-2022-0257GHSA-v567-q267-phpg21 Jan 2022

    pimcore is vulnerable to Cross-site Scripting

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • HighCVE-2022-0258GHSA-vj9x-w7ch-f46p21 Jan 2022

    pimcore is vulnerable to SQL Injection

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • MediumCVE-2022-0256GHSA-57hg-26h7-9qgv21 Jan 2022

    pimcore is vulnerable to Cross-site Scripting

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • HighCVE-2022-0263GHSA-c697-r227-pq6h21 Jan 2022

    Unrestricted Upload of File with Dangerous Type in pimcore

    Affected
    <10.2.7
    Fixed in
    10.2.7
  • MediumCVE-2022-0262GHSA-4f5x-q4jc-xfcf21 Jan 2022

    Cross-site Scripting in pimcore

    Affected
    <10.2.7
    Fixed in
    10.2.7
  • MediumCVE-2022-0285GHSA-pm3v-qxf6-fgxv21 Jan 2022

    Cross-site Scripting in pimcore

    Affected
    <10.2.9
    Fixed in
    10.2.9
  • MediumCVE-2021-4139GHSA-8xx9-rxrj-2m2w5 Jan 2022

    Cross-site Scripting in pimcore

    Affected
    <10.2.7
    Fixed in
    10.2.7
  • MediumCVE-2021-4084GHSA-8w3x-r6x7-c5r516 Dec 2021

    Cross-site Scripting in pimcore

    Affected
    <10.2.6
    Fixed in
    10.2.6
  • MediumCVE-2021-4082GHSA-2v2v-fx7r-f2fh16 Dec 2021

    pimcore is vulnerable to Cross-Site Request Forgery (CSRF)

    Affected
    <10.2.6
    Fixed in
    10.2.6
  • MediumCVE-2021-4081GHSA-3p85-p4qg-hcrp16 Dec 2021

    pimcore is vulnerable to Cross-site Scripting

    Affected
    <10.2.6
    Fixed in
    10.2.6
  • MediumCVE-2021-39189GHSA-579x-cjvr-cqj920 Sept 2021

    Observable Response Discrepancy in Lost Password Service

    Affected
    <10.1.3
    Fixed in
    10.1.3
  • HighCVE-2021-39166GHSA-w6j8-jc36-x5q91 Sept 2021

    Improper Neutralization of Text-Values in Object Version Preview

    Affected
    <10.1.2
    Fixed in
    10.1.2
  • HighCVE-2021-39170GHSA-2v88-qq7x-xq5f1 Sept 2021

    Improper Encoding or Escaping of Output in Asset Metadata Component

    Affected
    <10.1.2
    Fixed in
    10.1.2
  • MediumCVE-2021-37702GHSA-pp2h-95hm-hv9r30 Aug 2021

    Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore

    Affected
    <10.1.1
    Fixed in
    10.1.1
  • MediumGHSA-cfcv-q4qq-2ph423 Aug 2021

    CKEditor 4 vulnerabilities in versions <4.16.1

    Affected
    <10.1.1
    Fixed in
    10.1.1
  • HighCVE-2021-23405GHSA-g8jx-66p8-vcm213 Jul 2021

    SQL injection in pimcore/pimcore

    Affected
    <10.0.7
    Fixed in
    10.0.7
  • HighCVE-2021-23340GHSA-h7f9-cvh5-qw7f25 Feb 2021

    Path traversal in pimcore/pimcore

    Affected
    <6.8.8
    Fixed in
    6.8.8
  • MediumCVE-2019-10763GHSA-fpff-384j-vxq72 Dec 2019

    Data leakage via SQL Injection in Pimcore

    Affected
    <6.3.0
    Fixed in
    6.3.0

Which of your client projects are still on pimcore/pimcore 6.0?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact pimcore/pimcore version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other pimcore/pimcore versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.