VulertSecurity VulertSecurity

Vulnerability Database · Packagist · pimcore/pimcore · Version

pimcore/pimcore v12.3.0

v12.3.0 is affected by 139 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 4 High 34 Medium 101 Low 0 Unrated 0

All pimcore/pimcore versions & vulnerabilities → Search the database for this package →
Database updated 23/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

pimcore/pimcore v12.3.0 vulnerabilities

139 vulnerabilities cover pimcore/pimcore v12.3.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-55634: Pimcore Remote Code Execution via DataObject Class-Definition Field Name 9.9 critical 12.3.10 28 Aug 2026
CVE-2022-39365: RCE vulnerability in Pimcore/Mail & Dynamic Text Layout 9.8 critical 10.5.9 29 Oct 2022
CVE-2019-18981: Pimcore Access Control Issues 9.8 critical 6.2.2 24 May 2022
CVE-2019-18985: Pimcore 2FA Vulnerable to Brute Forcing 9.8 critical 6.2.2 24 May 2022
CVE-2026-23492: Pimcore Incomplete SQL Injection Patch Vulnerability 8.8 high 12.3.1 14 Jan 2026
CVE-2023-47637: Pimcore SQL Injection in Admin Grid Filter API 8.8 high 11.1.1 15 Nov 2023
CVE-2023-2338: SQL Injection in AssetController in pimcore/pimcore 8.8 high 10.5.21 27 Apr 2023
CVE-2023-30850: SQL Injection in Admin Translations API in pimcore/pimcore 8.8 high 10.5.21 27 Apr 2023
CVE-2023-30849: SQL Injection in pimcore/pimcore 8.8 high 10.5.21 27 Apr 2023
CVE-2023-30848: SQL Injection in pimcore/pimcore 8.8 high 10.5.21 27 Apr 2023
CVE-2023-25240: SameSite Attribute vulnerability in pimCore 8.8 high 10.5.16 13 Feb 2023
CVE-2019-16317: Pimcore RCE via PHAR upload 8.8 high 5.7.1 24 May 2022
Pimcore Unrestricted Upload of File with Dangerous Type 8.8 high 5.7.1 24 May 2022
CVE-2018-14057: Pimcore CSRF Vulnerability 8.8 high 5.3.0 14 May 2022
Pimcore Unserialize Remote Code Execution in pimcore/pimcore 8.8 high 5.7.1 13 May 2022
CVE-2021-23405: SQL Injection in pimcore/pimcore 8.8 high 10.0.7 13 Jul 2021
CVE-2026-44739: Pimcore SQL Injection Vulnerability in Custom Reports Configuration 8.7 high 12.3.6 27 May 2026
Sensitive Data Exposure in Pimcore due to HTTP Error Logging 8.6 high 12.3.1 15 Jan 2026
CVE-2022-0258: SQL Injection vulnerability in pimcore/pimcore 8.3 high 10.2.9 21 Jan 2022
CVE-2026-45260: Pimcore Asset Management Vulnerability Leading to Unauthorized Deletion via WebDAV MOVE 8.1 high 12.3.7 27 May 2026
CVE-2022-31092: Improper quoting of columns in Pimcore 8.1 high 10.4.4 22 Jun 2022
CVE-2026-45162: Pimcore Unsafe PHP Deserialization Vulnerability 8.0 high 12.3.7 27 May 2026
CVE-2021-39166: Improper Neutralization of Text-Values in Object Version Preview in pimcore/pimcore 8.0 high 10.1.2 01 Sep 2021
CVE-2021-39170: Improper Encoding or Escaping of Output in Asset Metadata Component in pimcore/pimcore 8.0 high 10.1.2 01 Sep 2021
CVE-2023-28108: Improper quoting of columns in UUID DAO model in pimcore/pimcore 7.9 high 10.5.19 17 Mar 2023
CVE-2022-0263: Unrestricted Upload of File with Dangerous Type in pimcore 7.8 high 10.2.7 21 Jan 2022
CVE-2023-3819: Pimcore Vulnerable to Exposure of Sensitive Information 7.6 high 10.6.4 21 Jul 2023
CVE-2019-18986: Pimcore Discloses Usernames In Use 7.5 high 6.2.2 24 May 2022
CVE-2022-1429: SQL Injection in Pimcore 7.5 high 10.3.6 23 Apr 2022
CVE-2022-1339: SQL Injection in Pimcore 7.5 high 10.3.5 14 Apr 2022
CVE-2022-1219: SQL Injection in Pimcore 7.5 high 10.3.5 09 Apr 2022
CVE-2026-11407: Pimcore CMS Twig Sandbox Bypass Vulnerability 7.2 high No fix published 17 Jun 2026
CVE-2023-3820: Pimcore SQL Injection in Dataobjects Sorting 7.2 high 10.6.4 21 Jul 2023
CVE-2023-3673: Pimcore SQL Injection vulnerability 7.2 high 10.5.24 14 Jul 2023
CVE-2026-45704: Pimcore CustomReports Share Bypass Vulnerability 7.1 high 12.3.6 27 May 2026
CVE-2021-23340: Path traversal in pimcore/pimcore 7.1 high 6.8.8 25 Feb 2021
CVE-2026-5394: SQL Injection Vulnerability in Pimcore Platform DataObject Class Definition Handling 7.0 high 12.3.7 28 May 2026
CVE-2026-5394: SQL Injection Vulnerability in Pimcore Package 7.0 high No fix published 27 Apr 2026
CVE-2026-27461: SQL Injection Vulnerability in Pimcore Package 6.9 medium No fix published 24 Feb 2026
CVE-2023-2616: Pimcore Cross-site Scripting (XSS) in Static Routes name field 6.8 medium 10.5.21 11 May 2023
CVE-2023-2615: Pimcore Cross-site Scripting (XSS) in Predefined Properties delete 6.8 medium 10.5.21 10 May 2023
Cross-site Scripting (XSS) in name field of Custom Reports in pimcore/pimcore 6.8 medium 10.5.21 10 May 2023
Duplicate Advisory: Cross-site Scripting (XSS) in Predefined Properties delete in pimcore/pimcore 6.8 medium 10.5.21 10 May 2023
Duplicate Advisory: Pimcore Cross-site Scripting (XSS) in Static Routes name field 6.8 medium 10.5.21 10 May 2023
CVE-2023-2323: Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field in pimcore/pimcore 6.8 medium 10.5.21 27 Apr 2023
CVE-2022-3255: Pimcore vulnerable to cross site scripting 6.8 medium 10.5.7 22 Sep 2022
CVE-2022-1351: Cross-site Scripting in Pimcore 6.8 medium 10.4 15 Apr 2022
CVE-2022-2796: Pimcore Cross-site Scripting (XSS) 6.7 medium 10.5.4 24 Aug 2022
CVE-2022-0262: Cross-site Scripting in pimcore 6.6 medium 10.2.7 21 Jan 2022
CVE-2021-4139: Cross-site Scripting in pimcore 6.6 medium 10.2.7 05 Jan 2022
CVE-2023-2983: Pimcore Privilege Defined With Unsafe Actions vulnerability 6.5 medium 10.5.23 06 Jun 2023
CVE-2023-30855: Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php 6.5 medium 10.5.18 02 May 2023
CVE-2023-2336: Path Traversal in Pimcore Asset "import from server" option 6.5 medium 10.5.21 27 Apr 2023
CVE-2023-1578: Pimcore Remote Code Execution vulnerability in Search function 6.5 medium 10.5.19 22 Mar 2023
CVE-2018-14058: Pimcore SQLi Vulnerability 6.5 medium 5.3.0 14 May 2022
CVE-2022-0665: Path traversal vulnerability in pimcore 6.5 medium 10.3.2 23 Feb 2022
CVE-2019-10763: SQL Injection in Pimcore 6.5 medium 6.3.0 02 Dec 2019
CVE-2026-45703: Pimcore WordExport Authorization Bypass Vulnerability 6.4 medium 12.3.7 27 May 2026
CVE-2022-0565: Exposure of Sensitive Information in pimcore/pimcore 6.4 medium 10.3.1 15 Feb 2022
CVE-2025-27617: SQL Injection Vulnerability in Pimcore Package 6.3 medium 11.5.4 11 Mar 2025
CVE-2023-38708: Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction 6.3 medium 10.6.7 03 Aug 2023
CVE-2023-2984: Pimcore vulnerable to Pre-Auth Path Traversal in pimcore_log parameter 6.3 medium 10.5.22 06 Jun 2023
CVE-2023-0827: Cross-site Scripting in pimcore 6.3 medium 1.5.17 14 Feb 2023
CVE-2023-28438: Pimcore vulnerable to improper quoting of filters in Custom Reports 6.2 medium 10.5.19 22 Mar 2023
CVE-2023-3821: Pimcore Cross-site Scripting vulnerability 6.1 medium 10.6.4 21 Jul 2023
CVE-2023-2341: Cross-site Scripting (XSS) in Admin Login too many attempts notice in pimcore/pimcore 6.1 medium 10.5.21 27 Apr 2023
CVE-2023-28429: Pimcore Cross-site Scripting Vulnerability in DataObject tooltip field 6.1 medium 10.5.19 20 Mar 2023
Pimcore Cross-site Scripting (XSS) Vulnerability in pimcore/pimcore 6.1 medium 6.3.0 24 May 2022
CVE-2019-18656: Pimcore XSS Vulnerability 6.1 medium 6.3.0 24 May 2022
CVE-2021-4084: Cross-site Scripting in pimcore 6.1 medium 10.2.6 16 Dec 2021
CVE-2021-4081: pimcore is vulnerable to Cross-site Scripting 6.1 medium 10.2.6 16 Dec 2021
CVE-2023-3822: Pimcore Cross-site Scripting vulnerability 6.0 medium 10.6.4 21 Jul 2023
CVE-2023-5873: Pimcore Cross-site Scripting vulnerability 5.4 medium 11.1.0 31 Oct 2023
CVE-2023-4453: Pimcore Cross-site Scripting (XSS) vulnerability in DataObject datetime fields 5.4 medium 10.6.8 21 Aug 2023
CVE-2023-2730: Pimcore Cross-site Scripting vulnerability 5.4 medium 10.3.3 16 May 2023
CVE-2023-23619: Code Injection Vulnerability in @asyncapi/modelina 5.4 medium 10.5.21 01 May 2023
CVE-2023-2361: Cross-site Scripting (XSS) in pimcore 5.4 medium 10.5.21 01 May 2023
CVE-2023-2340: Cross-site Scripting (XSS) in DataObject columns grid in pimcore/pimcore 5.4 medium 10.5.21 27 Apr 2023
CVE-2023-2339: Cross-site Scripting (XSS) in DataObject Any Getter grid operator in pimcore/pimcore 5.4 medium 10.5.21 27 Apr 2023
CVE-2023-2342: Cross-site Scripting (XSS) in pimcore/pimcore 5.4 medium 10.5.21 27 Apr 2023
CVE-2023-2343: Cross-site Scripting (XSS) in DataObject Classification Store 5.4 medium 10.5.21 27 Apr 2023
CVE-2023-1703: pimcore/pimcore - Cross-Site Scripting in Composite Indices Key Field 5.4 medium 10.5.20 04 Apr 2023
Cross-Site Scripting Vulnerability in pimcore/pimcore 5.4 medium 10.5.20 29 Mar 2023
CVE-2023-1515: Pimcore Vulnerable to Cross-site Scripting (XSS) in Redirects 5.4 medium 10.5.19 20 Mar 2023
CVE-2023-1429: Cross-site Scripting (XSS) in Document Types in pimcore/pimcore 5.4 medium 10.5.19 16 Mar 2023
CVE-2023-1247: Pimcore vulnerable to Cross-site Scripting 5.4 medium 11.0.0 07 Mar 2023
CVE-2023-1116: Pimcore Email Blacklist Cross Site Scripting Vulnerability 5.4 medium 10.5.18 01 Mar 2023
CVE-2023-1117: Pimcore vulnerable to Cross Site Scripting in image/video thumbnail config 5.4 medium 10.5.18 01 Mar 2023
CVE-2023-1115: Pimcore vulnerable to Cross Site Scripting in Documents Link Editable 5.4 medium 10.5.18 01 Mar 2023
CVE-2023-1067: Pimcore vulnerable to Cross-site Scripting 5.4 medium No fix published 27 Feb 2023
CVE-2023-23937: Unrestricted Upload of File with Dangerous Type in Pimcore 5.4 medium 10.5.16 02 Feb 2023
CVE-2023-0323: pimcore/pimcore - Cross-Site Scripting via "title field" in Data Objects 5.4 medium 10.5.14 20 Jan 2023
CVE-2022-32115: Known v1.3.1 - Code Execution via SVG File 5.4 medium 10.5.6 16 Sep 2022
CVE-2022-3211: Pimcore stored Cross-site Scripting via `properties` when creating new users 5.4 medium 10.5.6 16 Sep 2022
CVE-2018-14059: Pimcore XSS Vulnerability 5.4 medium 5.3.0 14 May 2022
CVE-2022-0911: Cross-site Scripting in Pimcore 5.4 medium 10.4.0 17 Mar 2022
CVE-2022-0704: Cross-site Scripting in Pimcore 5.4 medium 10.4.0 17 Mar 2022
CVE-2022-0705: Cross-site Scripting in Pimcore 5.4 medium 10.4.0 17 Mar 2022
CVE-2022-0894: Cross-site Scripting in Pimcore 5.4 medium 10.4.0 16 Mar 2022
CVE-2022-0893: Cross-site Scripting in Pimcore 5.4 medium 10.4.0 16 Mar 2022
CVE-2022-0832: Cross-site Scripting in Pimcore 5.4 medium 10.3.3 05 Mar 2022
CVE-2022-0831: Cross-site Scripting in Pimcore 5.4 medium 10.3.3 05 Mar 2022
CVE-2022-0509: Cross-site Scripting in pimcore 5.4 medium 10.3.1 09 Feb 2022
CVE-2022-0510: Cross-site Scripting in pimcore 5.4 medium 10.3.1 09 Feb 2022
CVE-2022-0348: Cross-site Scripting in pimcore 5.4 medium 10.2.10 28 Jan 2022
CVE-2022-0251: Cross-site Scripting in Pimcore 5.4 medium 10.2.10 27 Jan 2022
CVE-2022-0260: Cross-site Scripting in pimcore 5.4 medium 10.2.9 26 Jan 2022
CVE-2022-0257: pimcore/pimcore - Cross-site Scripting Vulnerability 5.4 medium 10.2.9 21 Jan 2022
CVE-2022-0256: pimcore is vulnerable to Cross-site Scripting 5.4 medium 10.2.9 21 Jan 2022
CVE-2022-0285: Cross-site Scripting in pimcore 5.4 medium 10.2.9 21 Jan 2022
CVE-2021-39189: Observable Response Discrepancy in Lost Password Service in pimcore/pimcore 5.3 medium 10.1.3 20 Sep 2021
CVE-2023-2328: Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition in pimcore/pimcore 5.2 medium 10.5.21 27 Apr 2023
CVE-2023-2322: Cross-site Scripting (XSS) in Document Properties Parameter in pimcore/pimcore 5.2 medium 10.5.21 27 Apr 2023
CVE-2026-5362: Pimcore Authenticated Cross-site Scripting Vulnerability 4.8 medium No fix published 27 Apr 2026
CVE-2023-26302: markdown-it-py Denial of Service vulnerability 4.8 medium 10.5.21 11 May 2023
CVE-2023-2630: Pimcore Cross-site Scripting (XSS) Vulnerability in Admin Translations 4.8 medium 10.5.21 11 May 2023
CVE-2023-1517: Pimcore Cross Site Scripting Vulnerability in Schedule Tab of Documents 4.8 medium 10.5.19 20 Mar 2023
CVE-2023-28106: Cross-site Scripting (XSS) in pimcore/pimcore 4.8 medium 10.5.19 17 Mar 2023
Reflected XSS in Application Logger module - pimcore/pimcore 4.8 medium 10.5.19 16 Mar 2023
CVE-2023-1312: pimcore is vulnerable to cross-site scripting 4.8 medium 10.5.19 10 Mar 2023
CVE-2023-1286: Cross-site Scripting (XSS) in pimcore/pimcore 4.8 medium 10.5.19 09 Mar 2023
CVE-2023-30852: Arbitrary File Read in Admin JS CSS files in pimcore/pimcore 4.4 medium 10.5.21 27 Apr 2023
CVE-2026-23494: Pimcore Vulnerable to Broken Access Control in Static Routes Listing 4.3 medium 12.3.1 15 Jan 2026
CVE-2021-4146: Business Logic Errors in pimcore 4.3 medium 10.2.9 26 Jan 2022
CVE-2021-40829: Improper certificate management in AWS IoT Device SDK v2 4.3 medium 10.2.6 16 Dec 2021
CVE-2021-4082: pimcore Cross-Site Request Forgery (CSRF) 4.3 medium 10.2.6 16 Dec 2021
CVE-2023-2332: Cross-site Scripting (XSS) in Conditions tab of Pricing Rules in pimcore/pimcore 4.0 medium 10.5.21 27 Apr 2023
CVE-2023-2327: Cross-site Scripting (XSS) in pimcore via DataObject Class date fields 4.0 medium 10.5.21 27 Apr 2023
CVE-2023-2614: Pimcore Cross-site Scripting (XSS) in Custom Reports N/A medium 10.5.21 10 May 2023
CVE-2023-1701: Pimcore Reflected XSS in Predefined Properties Module in Settings N/A medium 10.5.20 31 Mar 2023
CVE-2023-1702: Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings N/A medium 10.5.20 31 Mar 2023
CVE-2023-1704: pimcore/pimcore - Cross-Site Scripting Vulnerability in Translate Module N/A medium 10.5.20 31 Mar 2023
Cross-Site Scripting (XSS) Vulnerability in pimcore/pimcore N/A medium 10.5.20 29 Mar 2023
Duplicate Advisory: Pimcore Cross-site scripting in Predefined Asset Metadata module in Settings N/A medium 10.5.20 29 Mar 2023
Reflected XSS vulnerability in Pimcore's Predefined Properties module in Settings N/A medium 10.5.20 29 Mar 2023
Cross-site Scripting (XSS) Vulnerability in pimcore/pimcore N/A medium 10.5.19 16 Mar 2023
Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug - pimcore/pimcore N/A medium 10.5.17 15 Feb 2023
CVE-2021-37702: Improper Neutralization of Formula Elements in a CSV File in pimcore/pimcore N/A medium 10.1.1 30 Aug 2021
CKEditor 4 Vulnerabilities in Pimcore N/A medium 10.1.1 23 Aug 2021

Looking for another version, or everything Vulert holds for pimcore/pimcore?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About pimcore/pimcore v12.3.0

Is pimcore/pimcore v12.3.0 vulnerable?

Yes. 139 vulnerabilities in the Vulert database cover pimcore/pimcore v12.3.0: 4 critical, 34 high, 101 medium and 0 low. Each entry above names the fixed version to move to.

How do I monitor pimcore/pimcore for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the pimcore/pimcore version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.