Vulnerabilities > Pimcore
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-02-18 | CVE-2021-23340 | Path Traversal vulnerability in Pimcore This affects the package pimcore/pimcore before 6.8.8. | 7.1 |
| 2020-12-03 | CVE-2020-26246 | Improper Preservation of Permissions vulnerability in Pimcore Pimcore is an open source digital experience platform. | 6.5 |
| 2020-10-30 | CVE-2020-7759 | SQL Injection vulnerability in Pimcore The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. | 7.2 |
| 2019-11-18 | CVE-2019-10763 | SQL Injection vulnerability in Pimcore pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. | 6.5 |
| 2019-11-15 | CVE-2019-18986 | Improper Restriction of Excessive Authentication Attempts vulnerability in Pimcore Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users. | 7.5 |
| 2019-11-15 | CVE-2019-18985 | Improper Restriction of Excessive Authentication Attempts vulnerability in Pimcore Pimcore before 6.2.2 lacks brute force protection for the 2FA token. | 9.8 |
| 2019-11-15 | CVE-2019-18982 | Cross-site Scripting vulnerability in Pimcore bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header. | 6.1 |
| 2019-11-15 | CVE-2019-18981 | Inappropriate Encoding for Output Context vulnerability in Pimcore Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification. | 9.8 |
| 2019-10-31 | CVE-2019-18656 | Cross-site Scripting vulnerability in Pimcore 6.2.3 Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js mishandles certain HTML elements. | 6.1 |
| 2019-09-14 | CVE-2019-16318 | Unrestricted Upload of File with Dangerous Type vulnerability in Pimcore In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317. | 8.8 |