InfraGuard
ログイン 今すぐ試す 今すぐ購入

Pimcore の脆弱性（CVE一覧）

136 CVE9.9 最大CVSS

影響を受けるバージョン系列

既知の脆弱性

CVE タイトル 影響を受けるバージョン CVSS 悪用 EPSS 公開日
CVE-2026-109392 Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview ≤ 2026.3.1 5.1 — 2026-10-13
CVE-2026-55416 Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configur... * 8.8 — 2026-09-15
CVE-2026-55072 Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name * 8.5 — 2026-09-15
CVE-2026-55634 Pimcore: Remote Code Execution via DataObject Class-Definition Field Name * 9.9 — 2026-08-29
CVE-2026-55220 Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column * 9.3 — 2026-08-29
CVE-2026-44741 Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Prope... * 8.8 — 2026-08-13
CVE-2026-45704 Pimcore: CustomReports Share Bypass * 7.1 — 2026-07-18
CVE-2026-44739 Pimcore: SQL Injection in Custom Reports Column Configuration * 8.7 — 2026-07-18
CVE-2026-45260 Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling * 8.1 — 2026-07-18
CVE-2026-45703 Pimcore: WordExport Authorization Bypass for Unauthorized Document Export * 6.4 — 2026-07-18
CVE-2026-45162 Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction * 8.0 — 2026-07-18
CVE-2026-55207 Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin... * 8.8 — 2026-07-10
CVE-2026-55208 Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database d... * 7.7 — 2026-07-10
CVE-2026-55212 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation * 7.1 — 2026-07-10
CVE-2026-11407 Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed * 8.6 — 2026-06-18
CVE-2026-5362 Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering = v12.3.3 4.8 — 2026-04-28
CVE-2026-5394 Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling = 12.3.3 7.0 — 2026-04-28
CVE-2026-27461 Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause * 6.9 — 2026-02-24
CVE-2026-23496 Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization * 5.4 — 2026-01-16
CVE-2026-23494 Pimcore is Missing Function Level Authorization on "Static Routes" Listing * 4.3 — 2026-01-16
CVE-2026-23495 Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing * 4.3 — 2026-01-16
CVE-2026-23493 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log * 8.6 — 2026-01-16
CVE-2026-23492 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 * 8.8 — 2026-01-15
CVE-2025-27617 Pimcore Vulnerable to SQL Injection in getRelationFilterCondition * 6.3 — 2025-03-12
CVE-2024-11956 Pimcore customer-data-framework list sql injection * 5.1 — 2025-01-28
CVE-2023-2332 Stored Cross-site Scripting (XSS) in pimcore/pimcore * 4.0 — 2024-11-15
CVE-2024-49370 Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing * 8.7 — 2024-10-24
CVE-2024-32871 Pimcore Vulnerable to Flooding Server with Thumbnail files * 7.5 — 2024-06-04
CVE-2024-29197 Pimcore Preview Documents are not restricted to logged in users anymore * 6.5 — 2024-03-27
CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore * 8.8 — 2023-11-16
CVE-2023-46722 Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews * 6.1 — 2023-11-01
CVE-2023-5873 Cross-site Scripting (XSS) - Stored in pimcore/pimcore * 4.0 — 2023-10-31
CVE-2023-4453 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore * 6.4 — 2023-08-21
CVE-2023-38708 Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction * 6.3 — 2023-08-04
CVE-2023-3822 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore * 6.0 — 2023-07-21
CVE-2023-3821 Cross-site Scripting (XSS) - Stored in pimcore/pimcore * 6.1 — 2023-07-21
CVE-2023-3820 SQL Injection in pimcore/pimcore * 7.2 — 2023-07-21
CVE-2023-3819 Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore * 7.6 — 2023-07-21
CVE-2023-3673 SQL Injection in pimcore/pimcore * 7.2 — 2023-07-14
CVE-2023-2984 Path Traversal: '\..\filename' in pimcore/pimcore * 6.3 — 2023-05-30
CVE-2023-2983 Privilege Defined With Unsafe Actions in pimcore/pimcore * 6.5 — 2023-05-30
CVE-2023-2730 Cross-site Scripting (XSS) - Stored in pimcore/pimcore * 6.3 — 2023-05-16
CVE-2023-2616 Cross-site Scripting (XSS) - Generic in pimcore/pimcore * 6.8 — 2023-05-10
CVE-2023-2630 Cross-site Scripting (XSS) - Stored in pimcore/pimcore * 5.7 — 2023-05-10
CVE-2023-2614 Cross-site Scripting (XSS) - DOM in pimcore/pimcore * 6.8 — 2023-05-10
CVE-2023-2615 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore * 6.8 — 2023-05-10
CVE-2023-30855 Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php * 6.5 — 2023-05-09
CVE-2023-2361 Cross-site Scripting (XSS) - Stored in pimcore/pimcore * 6.3 — 2023-04-28
CVE-2023-30852 Pimcore Arbitrary File Read in Admin JS CSS files * 4.4 — 2023-04-28
CVE-2023-30850 Pimcore SQL Injection Vulnerability in Admin Translations API * 8.8 — 2023-04-28
CVE-2023-30849 Pimcore vulnerable to SQL Injection in Translation Export API * 8.8 — 2023-04-28
CVE-2023-30848 Pimcore SQL Injection Vulnerability in Admin Search Find API * 8.8 — 2023-04-28
CVE-2023-2340 Cross-site Scripting (XSS) - Stored in pimcore/pimcore * 6.1 — 2023-04-27
CVE-2023-2327 Cross-site Scripting (XSS) - Stored in pimcore/pimcore * 4.0 — 2023-04-27
CVE-2023-2339 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore * 6.1 — 2023-04-27
CVE-2023-2322 Cross-site Scripting (XSS) - Stored in pimcore/pimcore * 5.2 — 2023-04-27
CVE-2023-2336 Path Traversal in pimcore/pimcore * 5.5 — 2023-04-27
CVE-2023-2338 SQL Injection in pimcore/pimcore * 7.2 — 2023-04-27
CVE-2023-2328 Cross-site Scripting (XSS) - Generic in pimcore/pimcore * 5.2 — 2023-04-27
CVE-2023-2323 Cross-site Scripting (XSS) - Stored in pimcore/pimcore * 6.8 — 2023-04-27
公式サイト ソースコード SolutionMarket の掲載ページ

自社サーバーでこれらのバージョンを追跡

InfraGuard はすべてのサーバーからインストール済みソフトウェアのバージョンを収集し、既知の脆弱性があるものを通知します。セルフホスト型なので、データがネットワーク外に出ることはありません。

ライブデモを試す 今すぐ購入

悪用された脆弱性の週刊ダイジェスト

セルフホスト型サーバーに関係する KEV の追加情報を週1回お届けします。それ以外のメールは送りません。

データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。