영향받는 버전 라인
알려진 취약점
| CVE | 제목 | 영향 버전 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|---|
| CVE-2026-109392 | Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview | ≤ 2026.3.1 | 5.1 | — | 2026-10-13 | |
| CVE-2026-55416 | Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configur... | * | 8.8 | — | 2026-09-15 | |
| CVE-2026-55072 | Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name | * | 8.5 | — | 2026-09-15 | |
| CVE-2026-55634 | Pimcore: Remote Code Execution via DataObject Class-Definition Field Name | * | 9.9 | — | 2026-08-29 | |
| CVE-2026-55220 | Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column | * | 9.3 | — | 2026-08-29 | |
| CVE-2026-44741 | Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Prope... | * | 8.8 | — | 2026-08-13 | |
| CVE-2026-45704 | Pimcore: CustomReports Share Bypass | * | 7.1 | — | 2026-07-18 | |
| CVE-2026-44739 | Pimcore: SQL Injection in Custom Reports Column Configuration | * | 8.7 | — | 2026-07-18 | |
| CVE-2026-45260 | Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling | * | 8.1 | — | 2026-07-18 | |
| CVE-2026-45703 | Pimcore: WordExport Authorization Bypass for Unauthorized Document Export | * | 6.4 | — | 2026-07-18 | |
| CVE-2026-45162 | Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction | * | 8.0 | — | 2026-07-18 | |
| CVE-2026-55207 | Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin... | * | 8.8 | — | 2026-07-10 | |
| CVE-2026-55208 | Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database d... | * | 7.7 | — | 2026-07-10 | |
| CVE-2026-55212 | Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation | * | 7.1 | — | 2026-07-10 | |
| CVE-2026-11407 | Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed | * | 8.6 | — | 2026-06-18 | |
| CVE-2026-5362 | Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering | = v12.3.3 | 4.8 | — | 2026-04-28 | |
| CVE-2026-5394 | Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling | = 12.3.3 | 7.0 | — | 2026-04-28 | |
| CVE-2026-27461 | Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause | * | 6.9 | — | 2026-02-24 | |
| CVE-2026-23496 | Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization | * | 5.4 | — | 2026-01-16 | |
| CVE-2026-23494 | Pimcore is Missing Function Level Authorization on "Static Routes" Listing | * | 4.3 | — | 2026-01-16 | |
| CVE-2026-23495 | Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing | * | 4.3 | — | 2026-01-16 | |
| CVE-2026-23493 | Pimcore ENV Variables and Cookie Informations are exposed in http_error_log | * | 8.6 | — | 2026-01-16 | |
| CVE-2026-23492 | Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 | * | 8.8 | — | 2026-01-15 | |
| CVE-2025-27617 | Pimcore Vulnerable to SQL Injection in getRelationFilterCondition | * | 6.3 | — | 2025-03-12 | |
| CVE-2024-11956 | Pimcore customer-data-framework list sql injection | * | 5.1 | — | 2025-01-28 | |
| CVE-2023-2332 | Stored Cross-site Scripting (XSS) in pimcore/pimcore | * | 4.0 | — | 2024-11-15 | |
| CVE-2024-49370 | Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing | * | 8.7 | — | 2024-10-24 | |
| CVE-2024-32871 | Pimcore Vulnerable to Flooding Server with Thumbnail files | * | 7.5 | — | 2024-06-04 | |
| CVE-2024-29197 | Pimcore Preview Documents are not restricted to logged in users anymore | * | 6.5 | — | 2024-03-27 | |
| CVE-2023-47637 | SQL Injection in Admin Grid Filter API in Pimcore | * | 8.8 | — | 2023-11-16 | |
| CVE-2023-46722 | Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews | * | 6.1 | — | 2023-11-01 | |
| CVE-2023-5873 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore | * | 4.0 | — | 2023-10-31 | |
| CVE-2023-4453 | Cross-site Scripting (XSS) - Reflected in pimcore/pimcore | * | 6.4 | — | 2023-08-21 | |
| CVE-2023-38708 | Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction | * | 6.3 | — | 2023-08-04 | |
| CVE-2023-3822 | Cross-site Scripting (XSS) - Reflected in pimcore/pimcore | * | 6.0 | — | 2023-07-21 | |
| CVE-2023-3821 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore | * | 6.1 | — | 2023-07-21 | |
| CVE-2023-3820 | SQL Injection in pimcore/pimcore | * | 7.2 | — | 2023-07-21 | |
| CVE-2023-3819 | Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore | * | 7.6 | — | 2023-07-21 | |
| CVE-2023-3673 | SQL Injection in pimcore/pimcore | * | 7.2 | — | 2023-07-14 | |
| CVE-2023-2984 | Path Traversal: '\..\filename' in pimcore/pimcore | * | 6.3 | — | 2023-05-30 | |
| CVE-2023-2983 | Privilege Defined With Unsafe Actions in pimcore/pimcore | * | 6.5 | — | 2023-05-30 | |
| CVE-2023-2730 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore | * | 6.3 | — | 2023-05-16 | |
| CVE-2023-2616 | Cross-site Scripting (XSS) - Generic in pimcore/pimcore | * | 6.8 | — | 2023-05-10 | |
| CVE-2023-2630 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore | * | 5.7 | — | 2023-05-10 | |
| CVE-2023-2614 | Cross-site Scripting (XSS) - DOM in pimcore/pimcore | * | 6.8 | — | 2023-05-10 | |
| CVE-2023-2615 | Cross-site Scripting (XSS) - Reflected in pimcore/pimcore | * | 6.8 | — | 2023-05-10 | |
| CVE-2023-30855 | Pimcore Path Traversal Vulnerability in AdminBundle/Controller/Reports/CustomReportController.php | * | 6.5 | — | 2023-05-09 | |
| CVE-2023-2361 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore | * | 6.3 | — | 2023-04-28 | |
| CVE-2023-30852 | Pimcore Arbitrary File Read in Admin JS CSS files | * | 4.4 | — | 2023-04-28 | |
| CVE-2023-30850 | Pimcore SQL Injection Vulnerability in Admin Translations API | * | 8.8 | — | 2023-04-28 | |
| CVE-2023-30849 | Pimcore vulnerable to SQL Injection in Translation Export API | * | 8.8 | — | 2023-04-28 | |
| CVE-2023-30848 | Pimcore SQL Injection Vulnerability in Admin Search Find API | * | 8.8 | — | 2023-04-28 | |
| CVE-2023-2340 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore | * | 6.1 | — | 2023-04-27 | |
| CVE-2023-2327 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore | * | 4.0 | — | 2023-04-27 | |
| CVE-2023-2339 | Cross-site Scripting (XSS) - Reflected in pimcore/pimcore | * | 6.1 | — | 2023-04-27 | |
| CVE-2023-2322 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore | * | 5.2 | — | 2023-04-27 | |
| CVE-2023-2336 | Path Traversal in pimcore/pimcore | * | 5.5 | — | 2023-04-27 | |
| CVE-2023-2338 | SQL Injection in pimcore/pimcore | * | 7.2 | — | 2023-04-27 | |
| CVE-2023-2328 | Cross-site Scripting (XSS) - Generic in pimcore/pimcore | * | 5.2 | — | 2023-04-27 | |
| CVE-2023-2323 | Cross-site Scripting (XSS) - Stored in pimcore/pimcore | * | 6.8 | — | 2023-04-27 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).