repository icon
pimcore / pimcore Project repository

Core Framework for the Open Source Data & Experience Management Platform (PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce)

Submit a report

FIRST INTERACTION

WITHIN3 DAYS

REVIEW

WITHIN24 DAYS

FIX

WITHIN21 DAYS

Cross-site Scripting (XSS) - Stored
nam-no
self closed
CSRF Leading to create a new customer
mdakh404
pending
Session do not expiring on successful password reset
th3l0newolf
duplicate
Medium
Session is still valid after changing password
m4noo
self closed
Stored html injection
tharunavula
not applicable
host header injection leads to open redirect on https://demo.pimcore.fun/admin
bevennyamande
informative
None
Stored XSS via SVG File Upload
hackeruniverse
informative
High
SQL injection in Data Objects function
hiu240900
High
•$40•CVE-2023-3820
Stored html injection on segment name
si13ntr311ik
self closed
Confidential information provided to user with no permissions
dkarlovi
High
•$40•CVE-2023-3819
SQL injection in some Admin Sort functions
hiu240900
High
•$40•CVE-2023-3673
Business Logic Bypass - Ability to create new Customer with Newsletter Confirmed...
dyn20
informative
High
Exposed php info that contains sensitive informations
anasboulbali
not applicable
Busines Logic Errors when buying cars
abdulmajidmk
not applicable
privilege escalation with least config
duyhm1995
Medium
•$15•CVE-2023-2983
Stored XSS in module Snippet of "/en/shared/teasers/News"
chucsse
duplicate
Medium
Stored xss in module name "Content-Page"
chucsse
informative
Medium
Stored XSS in module name "Edit Link"
chucsse
Medium
•$15•CVE-2023-3822
Stored XSS in module name "Search Documents"
chucsse
Medium
•$15•CVE-2023-3821
Account Takeover
novemberdad
informative
High
Pre-Auth Path traversal in pimcore_log, leading potential DOS
hi-unc1e
Medium
•$15•CVE-2023-2984
XSS in Documents
70rpedo
duplicate
Medium
HTML injection in Documents, Data Objects and Assets of System Settings
nhaanhaa
informative
Medium
HTML injection in Conditions of Global Targeting Rules
nhaanhaa
informative
Medium
Full Path Disclosure (FPD) via re-export document
xcapri
self closed
HTML injection in DateTime of Classes in Data Objects module
khanhchauminh
duplicate
Medium
HTML injection in Application Logger module
khanhchauminh
informative
Medium
XSS in Document Home Page
hieuminhnv
informative
Medium
XSS in choose time value Classes Data Objects
hieuminhnv
Medium
•$15•CVE-2023-4453
Business Logic Errors in Customer automation rules
khanhchauminh
informative
Medium
XSS in Seo & Settings tab of Documents in pimcore/pimcore
duyhm1995
Medium
•$15•CVE-2023-2730
ADMIN OWNER LEAKAGE LEAD TO IMPROPER ACCESS CONTROL
novemberdad
informative
High
ADMIN EMAIL OWNER LEAKAGE LEAD TO IMPROPER ACCESS CONTROL
novemberdad
informative
High
SQL injection in AssetController.php
jomc98
duplicate
High
XSS in Translations
70rpedo
Medium
•$15•CVE-2023-2630
Stored cross site scripting vulnerability in operator any getter in pimcore grid...
asura-n
Medium
•$15•CVE-2023-2339
Bypass Stored XSS in Catalog
hieuminhnv
Medium
•$15•CVE-2023-2361
Stored cross site scripting vulnerability in Save grid option in pimcore dashboa...
asura-n
Medium
•$15•CVE-2023-2340
Stored XSS in editable content
miiajj
informative
Medium
XSS in Conditions tab of Pricing Rules
nhaanhaa
Medium
•$15•CVE-2023-2332
multiple unrestricted file operations functionalities leading to RCE
rekter0
not applicable
arbitrary file read
rekter0
Medium
•$15•CVE-2023-2336
SSRF
rekter0
not applicable
XSS in Classification Store of Data Objects module in Settings
khanhchauminh
Medium
•$15•CVE-2023-2343
XSS in Upload file PDF in pimcore/pimcore
tht1997
Medium
•CVE-2023-5873
XSS in Quantity Value of Data Objects module in Settings
khanhchauminh
Medium
•$15•CVE-2023-2328
XSS in Classes of Data Objects module in Settings
khanhchauminh
Medium
•$15•CVE-2023-2327
Dom-based XSS in Website Settings module in Settings
khanhchauminh
Medium
•$15•CVE-2023-2342
sql injection
rekter0
High
•$40•CVE-2023-2338
Stored XSS in text editor
pwnsauc3
informative
Medium
Cross site scripting on the login page
anasboulbali
High
•$40•CVE-2023-2341
Stored XSS in Featurette Module
pwnsauc3
informative
Medium
Reflected XSS in Predefined Metadata Definitions
voidenum
self closed
Stored XSS via name parameter of "Predefined Properties"
sampritdas8
Medium
•$15•CVE-2023-2615
Stored XSS in name parameter of "Customers Reports"
sampritdas8
Medium
•$15•CVE-2023-2614
Stored XSS in name parameter of "Static Routes"
sampritdas8
Medium
•$15•CVE-2023-2616
Multiple Stored XSS in name parameter of "Pricing Rules", "Predefined Properties...
sampritdas8
Medium
•$18•CVE-2023-2323
Cross site scripting on setting module
ghostbit11
Medium
•$15•CVE-2023-1704
Stored XSS in Properties Parameter
rootxsandy
Medium
•$15•CVE-2023-2322
Password reset link not expired
oiiwroo
informative
Medium
XSS in Predefined Asset Metadata module in Settings
nhaanhaa
Medium
•$15•CVE-2023-1702
Reflected XSS in Predefined Properties module in Settings
nhaanhaa
Medium
•$15•CVE-2023-1701
Cross Site Scripting (XSS) in Layers of Image
onkar0219
informative
Medium
XSS in Document Types module in Settings
khanhchauminh
Medium
•$15•CVE-2023-1429
cross site scripting
ghostbit11
Medium
•$15•CVE-2023-1703
Cross Site Scripting (XSS) in UrlSlug
onkar0219
Medium
•$15
XSS in Schedule tab of Documents
khanhchauminh
Medium
•$15•CVE-2023-1517
Bypass Stored cross site scripting in html-tags in seo&setting in home
rutvikhajare
duplicate
High
XSS Stored in perspective name
cupc4k3
self closed
Reflected XSS in Application Logger module
khanhchauminh
Medium
•$15•CVE-2023-1312
Stored XSS when delete an email in Blacklist
khanhchauminh
self closed
Stored xss in print generate and preview pdf
vishnuraj-r
Medium
•$15•CVE-2023-1286
Stored XSS in the Redirects module
khanhchauminh
Medium
•$15•CVE-2023-1515
SQL injection search function
com0t
Medium
•$15•CVE-2023-1578
Stored XSS in 'Basic function'
com0t
duplicate
High
XSS in GDPR Data Extractor
hieuminhnv
duplicate
High
XSS in button home page
hieuminhnv
High
•$40•CVE-2023-1115
Vulnerable JavaScript dependency
dmandefy
informative
High
XSS via Error Logic
p0cas
duplicate
Critical
No length on password lead to Dos
sl4x0
informative
High
No Rate Limit On Forgot Password Lead to Email Boombing
sl4x0
informative
Medium
Weak Password Policy Lead to Account Takeover
sl4x0
informative
Critical
Cross-site Scripting (XSS) - Stored
p0cas
Medium
•$15•CVE-2023-1117
XSS Stored in the email address
cupc4k3
Medium
•CVE-2023-1067
Stored XSS in Email Blacklist Function
0xy37
Medium
•CVE-2023-1116
EXIF Geolocation Data Not Stripped From Uploaded Images
earth2sky
not applicable
Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug
sanket-722
Medium
•CVE-2023-0827
Stored Cross site scripting in pimcore/pimcore
asura-n
duplicate
Medium
XSS in HTML-Tags
sanket-722
Medium
•$15•CVE-2023-1247
User/Mail Enumeration through Passwort Reset and Registration Functionality
ahmedvienna
informative
Medium
User Termination after Logout not working properly
ahmedvienna
informative
Medium
Reflected XSS at "https://demo.pimcore.com/admin/" `perspective=` Parameter
sl4x0
self closed
Cross-site request forgery (CSRF)
0ozero0
informative
Medium
Denial of service when enter long Password
0ozero0
informative
None
File Upload Type Validation Error
ctflearner
High
Cross site scripting vulnerability in pimcore
asura-n
Medium
•CVE-2023-0323
Reflected XSS In User/Roles Function
ht11761
Medium
•CVE-2022-3255
Error content is leak
uonghoangminhchau
informative
Medium
Stored Cross Site Scripting (XSS) via "properties" during creating new users
saitamang
Medium
•CVE-2022-3211
[CVE-2022-2796] Bypass | Stored XSS on Admin Translations
ayoub0x1
duplicate
High
Stored XSS on Admin Translations
ahkecha
Medium
•CVE-2022-2796
Remote code execution
7h3h4ckv157
informative
Critical
Store XSS via upload html file
dyn20
not applicable
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
7h3h4ckv157
Medium
SQL injection in GridHelperService.php
mylong
High
•$15•CVE-2022-1429
XSS in Setting/Bundle & Briques
minhnb11
not applicable
SQL injection in ElementController.php
mylong
High
•$15•CVE-2022-1339
SQL injection in RecyclebinController.php
mylong
High
•$15•CVE-2022-1219
Stored XSS when using Ext.form.TextField without proper renderer
mylong
not applicable
Stored XSS in Tooltip
mylong
Medium
•CVE-2022-1351
Cross-site Scripting (XSS) - Stored
scriptidiot
Medium
•CVE-2022-0911
Cross-site Scripting (XSS) - Stored
scriptidiot
Medium
•CVE-2022-0893
Cross-site Scripting (XSS) - Stored
noobpk
High
•$15•CVE-2022-0894
Cross-site Scripting (XSS) - Stored
khanhchauminh
Medium
•CVE-2022-0831
Cross-site Scripting (XSS) - Stored
khanhchauminh
Medium
•CVE-2022-0832
Path Traversal
nhiephon
Medium
•$8•CVE-2022-0665
Cross-site Scripting (XSS) - Stored
p0cas
Medium
•$15•CVE-2022-0705
Cross-site Scripting (XSS) - Stored
asura-n
Medium
•$15•CVE-2022-0704
Cross-site Scripting (XSS) - Stored
p0cas
Medium
•CVE-2022-0509
Cross-site Scripting (XSS) - Reflected
asura-n
Medium
•$20•CVE-2022-0510
Exposure of Sensitive Information to an Unauthorized Actor
ranjit-git
High
•$40•CVE-2022-0565
Cross-site Scripting (XSS) - Stored
asura-n
Medium
•$12•CVE-2022-0348
Cross-site Scripting (XSS) - Stored
inweol
Medium
•CVE-2022-0285
Unrestricted Upload of File with Dangerous Type
p0cas
Medium
•$30•CVE-2022-0263
Cross-site Scripting (XSS) - Stored
p0cas
Medium
•$25•CVE-2022-0262
Cross-site Scripting (XSS) - Stored
khanhchauminh
Medium
•$25•CVE-2022-0260
SQL Injection
laladee
High
•$50•CVE-2022-0258
Cross-site Scripting (XSS) - Stored
p0cas
Medium
•CVE-2022-0257
Cross-site Scripting (XSS) - Stored
asura-n
Medium
•CVE-2022-0256
Cross-site Scripting (XSS) - Stored
itsfading
High
•$5•CVE-2022-0251
Cross-site Scripting (XSS) - Stored
laladee
Medium
•$55•CVE-2021-4139
Business Logic Errors
dev696
Medium
•$50•CVE-2021-4146
Cross-site Scripting (XSS) - Reflected
khanhchauminh
Medium
•$25•CVE-2021-4081
Cross-Site Request Forgery (CSRF)
khanhchauminh
Medium
•$25•CVE-2021-4082
Cross-site Scripting (XSS) - Stored
shellinjector
High
•$25•CVE-2021-4084
Cross-site Scripting (XSS) - Stored
shellinjector
Critical
•$25
Unrestricted Upload of File with Dangerous Type
aravindd007
Medium
•$40
Server-Side Request Forgery (SSRF)
lfama
High
•$32
Observable Response Discrepancy
0xsmiley
Medium
•$40
Cross-site Scripting (XSS) - Stored
b1nslashsh
Medium
Cross-site Scripting (XSS) - Stored
b1nslashsh
High
•$40
Cross-site Scripting (XSS) - Stored
b1nslashsh
Medium
•$40
Cross-Site Request Forgery (CSRF)
am0o0
Medium
•$36
Weak Password Requirements
sudheendra17
Medium
Cross-Site Request Forgery (CSRF)
am0o0
High
•$40
Business Logic Errors
effectrenan
High
•$40
Cross-site Scripting (XSS) - Stored
b1nslashsh
Medium
•$32