CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 5CVE-2018-14059 – Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2018-14059
16 Aug 2018 — Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions. Pimcore permite Cross-Site Scripting (XSS) mediante las funciones Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity... • https://packetstorm.news/files/id/148954 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 2CVE-2014-2921 – Pimcore CMS 1.4.9 <2.1.0 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-2921
21 Apr 2014 — The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a Zend_Pdf_ElementFactory_Proxy object and a pathname with a trailing \0 character. La función getObjectByToken en Newsletter.php en el módulo Pimcore_Tool_Newsletter en pimcore 1.4.9 hasta 2.0.0... • https://www.exploit-db.com/exploits/43886 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 2CVE-2014-2922 – Pimcore CMS 1.4.9 <2.1.0 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2014-2922
21 Apr 2014 — The getObjectByToken function in Newsletter.php in the Pimcore_Tool_Newsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors involving a Zend_Http_Response_Stream object. La función getObjectByToken en Newsletter.php en el módulo Pimcore_Tool_Newsletter en pimcore 1.4.9 hasta 2.1.0 no maneja debidamente un objeto obtenido deserializando... • https://www.exploit-db.com/exploits/43886 • CWE-20: Improper Input Validation •