VulertSecurity VulertSecurity

Vulnerability Database · Packagist · pimcore/pimcore · Version

pimcore/pimcore v11.2.1

v11.2.1 is affected by 138 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 4 High 33 Medium 101 Low 0 Unrated 0

All pimcore/pimcore versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

pimcore/pimcore v11.2.1 vulnerabilities

138 vulnerabilities cover pimcore/pimcore v11.2.1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-55634: Pimcore Remote Code Execution via DataObject Class-Definition Field Name 9.9 critical 12.3.10 28 Aug 2026
CVE-2022-39365: RCE vulnerability in Pimcore/Mail & Dynamic Text Layout 9.8 critical 10.5.9 29 Oct 2022
CVE-2019-18981: Pimcore Access Control Issues 9.8 critical 6.2.2 24 May 2022
CVE-2019-18985: Pimcore 2FA Vulnerable to Brute Forcing 9.8 critical 6.2.2 24 May 2022
CVE-2023-47637: Pimcore SQL Injection in Admin Grid Filter API 8.8 high 11.1.1 15 Nov 2023
CVE-2023-2338: SQL Injection in AssetController in pimcore/pimcore 8.8 high 10.5.21 27 Apr 2023
CVE-2023-30850: SQL Injection in Admin Translations API in pimcore/pimcore 8.8 high 10.5.21 27 Apr 2023
CVE-2023-30849: SQL Injection in pimcore/pimcore 8.8 high 10.5.21 27 Apr 2023
CVE-2023-30848: SQL Injection in pimcore/pimcore 8.8 high 10.5.21 27 Apr 2023
CVE-2023-25240: SameSite Attribute vulnerability in pimCore 8.8 high 10.5.16 13 Feb 2023
CVE-2019-16317: Pimcore RCE via PHAR upload 8.8 high 5.7.1 24 May 2022
Pimcore Unrestricted Upload of File with Dangerous Type 8.8 high 5.7.1 24 May 2022
CVE-2018-14057: Pimcore CSRF Vulnerability 8.8 high 5.3.0 14 May 2022
Pimcore Unserialize Remote Code Execution in pimcore/pimcore 8.8 high 5.7.1 13 May 2022
CVE-2021-23405: SQL Injection in pimcore/pimcore 8.8 high 10.0.7 13 Jul 2021
CVE-2026-44739: Pimcore SQL Injection Vulnerability in Custom Reports Configuration 8.7 high 12.3.6 27 May 2026
CVE-2022-0258: SQL Injection vulnerability in pimcore/pimcore 8.3 high 10.2.9 21 Jan 2022
CVE-2026-45260: Pimcore Asset Management Vulnerability Leading to Unauthorized Deletion via WebDAV MOVE 8.1 high 12.3.7 27 May 2026
CVE-2022-31092: Improper quoting of columns in Pimcore 8.1 high 10.4.4 22 Jun 2022
CVE-2026-45162: Pimcore Unsafe PHP Deserialization Vulnerability 8.0 high 12.3.7 27 May 2026
CVE-2021-39166: Improper Neutralization of Text-Values in Object Version Preview in pimcore/pimcore 8.0 high 10.1.2 01 Sep 2021
CVE-2021-39170: Improper Encoding or Escaping of Output in Asset Metadata Component in pimcore/pimcore 8.0 high 10.1.2 01 Sep 2021
CVE-2023-28108: Improper quoting of columns in UUID DAO model in pimcore/pimcore 7.9 high 10.5.19 17 Mar 2023
CVE-2022-0263: Unrestricted Upload of File with Dangerous Type in pimcore 7.8 high 10.2.7 21 Jan 2022
CVE-2023-3819: Pimcore Vulnerable to Exposure of Sensitive Information 7.6 high 10.6.4 21 Jul 2023
CVE-2024-32871: Flooding Server with Thumbnail files in Pimcore 7.5 high 11.2.4 04 Jun 2024
CVE-2019-18986: Pimcore Discloses Usernames In Use 7.5 high 6.2.2 24 May 2022
CVE-2022-1429: SQL Injection in Pimcore 7.5 high 10.3.6 23 Apr 2022
CVE-2022-1339: SQL Injection in Pimcore 7.5 high 10.3.5 14 Apr 2022
CVE-2022-1219: SQL Injection in Pimcore 7.5 high 10.3.5 09 Apr 2022
CVE-2026-11407: Pimcore CMS Twig Sandbox Bypass Vulnerability 7.2 high No fix published 17 Jun 2026
CVE-2023-3820: Pimcore SQL Injection in Dataobjects Sorting 7.2 high 10.6.4 21 Jul 2023
CVE-2023-3673: Pimcore SQL Injection vulnerability 7.2 high 10.5.24 14 Jul 2023
CVE-2026-45704: Pimcore CustomReports Share Bypass Vulnerability 7.1 high 12.3.6 27 May 2026
CVE-2021-23340: Path traversal in pimcore/pimcore 7.1 high 6.8.8 25 Feb 2021
CVE-2026-5394: SQL Injection Vulnerability in Pimcore Platform DataObject Class Definition Handling 7.0 high 12.3.7 28 May 2026
CVE-2026-5394: SQL Injection Vulnerability in Pimcore Package 7.0 high No fix published 27 Apr 2026
CVE-2026-27461: SQL Injection Vulnerability in Pimcore Package 6.9 medium No fix published 24 Feb 2026
CVE-2023-2616: Pimcore Cross-site Scripting (XSS) in Static Routes name field 6.8 medium 10.5.21 11 May 2023
CVE-2023-2615: Pimcore Cross-site Scripting (XSS) in Predefined Properties delete 6.8 medium 10.5.21 10 May 2023
Cross-site Scripting (XSS) in name field of Custom Reports in pimcore/pimcore 6.8 medium 10.5.21 10 May 2023
Duplicate Advisory: Cross-site Scripting (XSS) in Predefined Properties delete in pimcore/pimcore 6.8 medium 10.5.21 10 May 2023
Duplicate Advisory: Pimcore Cross-site Scripting (XSS) in Static Routes name field 6.8 medium 10.5.21 10 May 2023
CVE-2023-2323: Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field in pimcore/pimcore 6.8 medium 10.5.21 27 Apr 2023
CVE-2022-3255: Pimcore vulnerable to cross site scripting 6.8 medium 10.5.7 22 Sep 2022
CVE-2022-1351: Cross-site Scripting in Pimcore 6.8 medium 10.4 15 Apr 2022
CVE-2022-2796: Pimcore Cross-site Scripting (XSS) 6.7 medium 10.5.4 24 Aug 2022
CVE-2022-0262: Cross-site Scripting in pimcore 6.6 medium 10.2.7 21 Jan 2022
CVE-2021-4139: Cross-site Scripting in pimcore 6.6 medium 10.2.7 05 Jan 2022
CVE-2023-2983: Pimcore Privilege Defined With Unsafe Actions vulnerability 6.5 medium 10.5.23 06 Jun 2023
CVE-2023-30855: Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php 6.5 medium 10.5.18 02 May 2023
CVE-2023-2336: Path Traversal in Pimcore Asset "import from server" option 6.5 medium 10.5.21 27 Apr 2023
CVE-2023-1578: Pimcore Remote Code Execution vulnerability in Search function 6.5 medium 10.5.19 22 Mar 2023
CVE-2018-14058: Pimcore SQLi Vulnerability 6.5 medium 5.3.0 14 May 2022
CVE-2022-0665: Path traversal vulnerability in pimcore 6.5 medium 10.3.2 23 Feb 2022
CVE-2019-10763: SQL Injection in Pimcore 6.5 medium 6.3.0 02 Dec 2019
CVE-2026-45703: Pimcore WordExport Authorization Bypass Vulnerability 6.4 medium 12.3.7 27 May 2026
CVE-2022-0565: Exposure of Sensitive Information in pimcore/pimcore 6.4 medium 10.3.1 15 Feb 2022
CVE-2025-27617: SQL Injection Vulnerability in Pimcore Package 6.3 medium 11.5.4 11 Mar 2025
CVE-2023-38708: Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction 6.3 medium 10.6.7 03 Aug 2023
CVE-2023-2984: Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter 6.3 medium 10.5.22 06 Jun 2023
CVE-2023-0827: Cross-site Scripting in pimcore 6.3 medium 1.5.17 14 Feb 2023
CVE-2023-28438: Pimcore vulnerable to improper quoting of filters in Custom Reports 6.2 medium 10.5.19 22 Mar 2023
Pimcore TinyMCE Bundle - tinymce Vulnerability 6.1 medium 11.2.3 24 Apr 2024
CVE-2023-3821: Pimcore Cross-site Scripting vulnerability 6.1 medium 10.6.4 21 Jul 2023
CVE-2023-2341: Cross-site Scripting (XSS) in Admin Login too many attempts notice in pimcore/pimcore 6.1 medium 10.5.21 27 Apr 2023
CVE-2023-28429: Pimcore Cross-site Scripting Vulnerability in DataObject tooltip field 6.1 medium 10.5.19 20 Mar 2023
Pimcore Cross-site Scripting (XSS) Vulnerability in pimcore/pimcore 6.1 medium 6.3.0 24 May 2022
CVE-2019-18656: Pimcore XSS Vulnerability 6.1 medium 6.3.0 24 May 2022
CVE-2021-4084: Cross-site Scripting in pimcore 6.1 medium 10.2.6 16 Dec 2021
CVE-2021-4081: pimcore is vulnerable to Cross-site Scripting 6.1 medium 10.2.6 16 Dec 2021
CVE-2023-3822: Pimcore Cross-site Scripting vulnerability 6.0 medium 10.6.4 21 Jul 2023
CVE-2023-5873: Pimcore Cross-site Scripting vulnerability 5.4 medium 11.1.0 31 Oct 2023
CVE-2023-4453: Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields 5.4 medium 10.6.8 21 Aug 2023
CVE-2023-2730: Pimcore Cross-site Scripting vulnerability 5.4 medium 10.3.3 16 May 2023
CVE-2023-23619: Code Injection Vulnerability in @asyncapi/modelina 5.4 medium 10.5.21 01 May 2023
CVE-2023-2361: Cross-site Scripting (XSS) in pimcore 5.4 medium 10.5.21 01 May 2023
CVE-2023-2340: Cross-site Scripting (XSS) in DataObject columns grid in pimcore/pimcore 5.4 medium 10.5.21 27 Apr 2023
CVE-2023-2339: Cross-site Scripting (XSS) in DataObject Any Getter grid operator in pimcore/pimcore 5.4 medium 10.5.21 27 Apr 2023
CVE-2023-2342: Cross-site Scripting (XSS) in pimcore/pimcore 5.4 medium 10.5.21 27 Apr 2023
CVE-2023-2343: Cross-site Scripting (XSS) in DataObject Classification Store 5.4 medium 10.5.21 27 Apr 2023
CVE-2023-1703: pimcore/pimcore - Cross-Site Scripting in Composite Indices Key Field 5.4 medium 10.5.20 04 Apr 2023
Cross-Site Scripting Vulnerability in pimcore/pimcore 5.4 medium 10.5.20 29 Mar 2023
CVE-2023-1515: Pimcore Vulnerable to Cross-site Scripting (XSS) in Redirects 5.4 medium 10.5.19 20 Mar 2023
CVE-2023-1429: Cross-site Scripting (XSS) in Document Types in pimcore/pimcore 5.4 medium 10.5.19 16 Mar 2023
CVE-2023-1247: Pimcore vulnerable to Cross-site Scripting 5.4 medium 11.0.0 07 Mar 2023
CVE-2023-1116: Pimcore Email Blacklist Cross Site Scripting Vulnerability 5.4 medium 10.5.18 01 Mar 2023
CVE-2023-1117: Pimcore vulnerable to Cross Site Scripting in image/video thumbnail config 5.4 medium 10.5.18 01 Mar 2023
CVE-2023-1115: Pimcore vulnerable to Cross Site Scripting in Documents Link Editable 5.4 medium 10.5.18 01 Mar 2023
CVE-2023-1067: Pimcore vulnerable to Cross-site Scripting 5.4 medium No fix published 27 Feb 2023
CVE-2023-23937: Unrestricted Upload of File with Dangerous Type in Pimcore 5.4 medium 10.5.16 02 Feb 2023
CVE-2023-0323: pimcore/pimcore - Cross-Site Scripting via "title field" in Data Objects 5.4 medium 10.5.14 20 Jan 2023
CVE-2022-32115: Known v1.3.1 - Code Execution via SVG File 5.4 medium 10.5.6 16 Sep 2022
CVE-2022-3211: Pimcore stored Cross-site Scripting via `properties` when creating new users 5.4 medium 10.5.6 16 Sep 2022
CVE-2018-14059: Pimcore XSS Vulnerability 5.4 medium 5.3.0 14 May 2022
CVE-2022-0911: Cross-site Scripting in Pimcore 5.4 medium 10.4.0 17 Mar 2022
CVE-2022-0704: Cross-site Scripting in Pimcore 5.4 medium 10.4.0 17 Mar 2022
CVE-2022-0705: Cross-site Scripting in Pimcore 5.4 medium 10.4.0 17 Mar 2022
CVE-2022-0894: Cross-site Scripting in Pimcore 5.4 medium 10.4.0 16 Mar 2022
CVE-2022-0893: Cross-site Scripting in Pimcore 5.4 medium 10.4.0 16 Mar 2022
CVE-2022-0832: Cross-site Scripting in Pimcore 5.4 medium 10.3.3 05 Mar 2022
CVE-2022-0831: Cross-site Scripting in Pimcore 5.4 medium 10.3.3 05 Mar 2022
CVE-2022-0509: Cross-site Scripting in pimcore 5.4 medium 10.3.1 09 Feb 2022
CVE-2022-0510: Cross-site Scripting in pimcore 5.4 medium 10.3.1 09 Feb 2022
CVE-2022-0348: Cross-site Scripting in pimcore 5.4 medium 10.2.10 28 Jan 2022
CVE-2022-0251: Cross-site Scripting in Pimcore 5.4 medium 10.2.10 27 Jan 2022
CVE-2022-0260: Cross-site Scripting in pimcore 5.4 medium 10.2.9 26 Jan 2022
CVE-2022-0257: pimcore/pimcore - Cross-site Scripting Vulnerability 5.4 medium 10.2.9 21 Jan 2022
CVE-2022-0256: pimcore is vulnerable to Cross-site Scripting 5.4 medium 10.2.9 21 Jan 2022
CVE-2022-0285: Cross-site Scripting in pimcore 5.4 medium 10.2.9 21 Jan 2022
CVE-2021-39189: Observable Response Discrepancy in Lost Password Service in pimcore/pimcore 5.3 medium 10.1.3 20 Sep 2021
CVE-2023-2328: Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition in pimcore/pimcore 5.2 medium 10.5.21 27 Apr 2023
CVE-2023-2322: Cross-site Scripting (XSS) in Document Properties Parameter in pimcore/pimcore 5.2 medium 10.5.21 27 Apr 2023
CVE-2026-5362: Pimcore Authenticated Cross-site Scripting Vulnerability 4.8 medium No fix published 27 Apr 2026
CVE-2023-26302: markdown-it-py Denial of Service vulnerability 4.8 medium 10.5.21 11 May 2023
CVE-2023-2630: Pimcore Cross-site Scripting (XSS) Vulnerability in Admin Translations 4.8 medium 10.5.21 11 May 2023
CVE-2023-1517: Pimcore Cross Site Scripting Vulnerability in Schedule Tab of Documents 4.8 medium 10.5.19 20 Mar 2023
CVE-2023-28106: Cross-site Scripting (XSS) in pimcore/pimcore 4.8 medium 10.5.19 17 Mar 2023
Reflected XSS in Application Logger module - pimcore/pimcore 4.8 medium 10.5.19 16 Mar 2023
CVE-2023-1312: pimcore is vulnerable to cross-site scripting 4.8 medium 10.5.19 10 Mar 2023
CVE-2023-1286: Cross-site Scripting (XSS) in pimcore/pimcore 4.8 medium 10.5.19 09 Mar 2023
CVE-2023-30852: Arbitrary File Read in Admin JS CSS files in pimcore/pimcore 4.4 medium 10.5.21 27 Apr 2023
CVE-2021-4146: Business Logic Errors in pimcore 4.3 medium 10.2.9 26 Jan 2022
CVE-2021-40829: Improper certificate management in AWS IoT Device SDK v2 4.3 medium 10.2.6 16 Dec 2021
CVE-2021-4082: pimcore Cross-Site Request Forgery (CSRF) 4.3 medium 10.2.6 16 Dec 2021
CVE-2023-2332: Cross-site Scripting (XSS) in Conditions tab of Pricing Rules in pimcore/pimcore 4.0 medium 10.5.21 27 Apr 2023
CVE-2023-2327: Cross-site Scripting (XSS) in pimcore via DataObject Class date fields 4.0 medium 10.5.21 27 Apr 2023
CVE-2023-2614: Pimcore Cross-site Scripting (XSS) in Custom Reports N/A medium 10.5.21 10 May 2023
CVE-2023-1701: Pimcore Reflected XSS in Predefined Properties Module in Settings N/A medium 10.5.20 31 Mar 2023
CVE-2023-1702: Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings N/A medium 10.5.20 31 Mar 2023
CVE-2023-1704: pimcore/pimcore - Cross-Site Scripting Vulnerability in Translate Module N/A medium 10.5.20 31 Mar 2023
Cross-Site Scripting (XSS) Vulnerability in pimcore/pimcore N/A medium 10.5.20 29 Mar 2023
Duplicate Advisory: Pimcore Cross-site scripting in Predefined Asset Metadata module in Settings N/A medium 10.5.20 29 Mar 2023
Reflected XSS vulnerability in Pimcore's Predefined Properties module in Settings N/A medium 10.5.20 29 Mar 2023
Cross-site Scripting (XSS) Vulnerability in pimcore/pimcore N/A medium 10.5.19 16 Mar 2023
Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug - pimcore/pimcore N/A medium 10.5.17 15 Feb 2023
CVE-2021-37702: Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore N/A medium 10.1.1 30 Aug 2021
CKEditor 4 Vulnerabilities in Pimcore N/A medium 10.1.1 23 Aug 2021

Looking for another version, or everything Vulert holds for pimcore/pimcore?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About pimcore/pimcore v11.2.1

Is pimcore/pimcore v11.2.1 vulnerable?

Yes. 138 vulnerabilities in the Vulert database cover pimcore/pimcore v11.2.1: 4 critical, 33 high, 101 medium and 0 low. Each entry above names the fixed version to move to.

How do I monitor pimcore/pimcore for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the pimcore/pimcore version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.