CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-27617 – Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
https://notcve.org/view.php?id=CVE-2025-27617
11 Mar 2025 — Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL injection. Version 11.5.4 fixes the issue. • https://github.com/pimcore/pimcore/blob/c721a42c23efffd4ca916511ddb969598d302396/models/DataObject/ClassDefinition/Data/Extension/RelationFilterConditionParser.php#L29-L47 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-32871 – Pimcore Vulnerable to Flooding Server with Thumbnail files
https://notcve.org/view.php?id=CVE-2024-32871
04 Jun 2024 — Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the original. This vulnerability is fixed in 11.2.4. Pimcore es una plataforma de gestión de experiencias y datos de código abierto. • https://github.com/pimcore/pimcore/commit/38af70b3130f16fc27f2aea34e2943d7bdaaba06 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-29197 – Pimcore Preview Documents are not restricted to logged in users anymore
https://notcve.org/view.php?id=CVE-2024-29197
26 Mar 2024 — Pimcore is an Open Source Data & Experience Management Platform. Any call with the query argument `?pimcore_preview=true` allows to view unpublished sites. In previous versions of Pimcore, session information would propagate to previews, so only a logged in user could open a preview. This no longer applies. • https://github.com/pimcore/pimcore/commit/3ae43fb1065f9eb62ad2f542b883858d36d57e53 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •