How many CVEs does pimcore have?

pimcore has 165 published CVE records since 2014, including 22 in the last two years.

How many pimcore CVEs are in CISA KEV?

None of pimcore's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which pimcore products have the most CVEs?

The pimcore products with the most published CVEs are pimcore, pimcore/pimcore, admin_classic_bundle, admin-ui-classic-bundle, customer-data-framework.

What are the most common weakness types in pimcore CVEs?

pimcore's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-284 (Improper Access Control), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

Are there public exploits for pimcore vulnerabilities?

Yes — 87 of pimcore's CVEs have a known public exploit.

How many critical pimcore vulnerabilities are there?

pimcore has 6 critical and 58 high-severity CVEs.

What is the average severity of pimcore CVEs?

The average CVSS base score across pimcore's scored CVEs is 6.6.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

165 CVEs

pimcore Vulnerabilities

Name: pimcore vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for pimcore.

165

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

87

Public exploits

PoC or exploit code

6.6

Avg CVSS

2014–2026

Overview

pimcore has 165 published CVE records since 2014, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 87 have a known public exploit. The average CVSS base score across scored CVEs is 6.6.

This page aggregates every publicly disclosed vulnerability (CVE) affecting pimcore products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on pimcore's vulnerability posture, as a share of its 165 published CVEs.

Average CVSS: 6.6
Critical / high: 39%
Actively exploited (KEV): 0%
Public exploit available: 53%
Patch available: 98%

Severity and exploitation

How the CVSS severity of pimcore's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical6

High58

Medium100

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of pimcore's CVEs are currently listed in CISA's KEV catalog.

Public exploits

87

87 of pimcore's CVEs have a known public exploit available.

Most affected products

The pimcore products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in pimcore CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish pimcore CVE records.

Disclosure activity by year

How many pimcore CVEs were published each year.

2019

9

2020

2

2021

12

2022

31

2023

70

2024

12

2025

5

2026

17

Latest pimcore CVEs

The most recently disclosed vulnerabilities affecting pimcore.

Pimcore: CustomReports Share Bypass
CWE-862
High · CVSS 7.1
EPSS 0.3%2026-07-17
Pimcore: SQL Injection in Custom Reports Column Configuration
CWE-89
High · CVSS 8.7
EPSS 0.3%2026-07-17
Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling
CWE-862
High · CVSS 8.1
EPSS 0.4%2026-07-17
Pimcore: WordExport Authorization Bypass for Unauthorized Document Export
CWE-862
Medium · CVSS 6.4
EPSS 0.2%2026-07-17
Pimcore: Unsafe PHP Deserialization in Multiple Locations Without allowed_classes Restriction
CWE-502
High · CVSS 8.0
EPSS 0.6%2026-07-17
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
CWE-640
High · CVSS 8.8
EPSS 0.4%2026-07-09
Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes
CWE-89
High · CVSS 7.7
EPSS 0.2%2026-07-09
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
CWE-285
High · CVSS 7.1
EPSS 0.2%2026-07-09
Pimcore CMS 12.3.8 Twig Sandbox Bypass via SecurityPolicy checkMethodAllowed
CWE-1336
High · CVSS 8.6
EPSS 0.6%2026-06-17
Pimcore Platform v12.3.3 - Stored XSS in Document Editable Embed rendering
CWE-79
Medium · CVSS 4.8
EPSS 0.2%2026-04-27
Pimcore Platform v12.3.3 - SQL Injection in DataObject composite index handling
CWE-89
High · CVSS 7.0
EPSS 0.3%2026-04-27
Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE clause
CWE-89
Medium · CVSS 6.9
EPSS 0.5%2026-02-24

Track new pimcore CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor pimcore CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

MongoDB168 CVEs BEA Systems168 CVEs Nokia167 CVEs openatom166 CVEs phpBB165 CVEs djangoproject164 CVEs Concrete CMS163 CVEs Rapid7162 CVEs

Browse all vendors

Frequently asked questions

Common questions about pimcore vulnerabilities.

How many CVEs does pimcore have?: pimcore has 165 published CVE records since 2014, including 22 in the last two years.
How many pimcore CVEs are in CISA KEV?: None of pimcore's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which pimcore products have the most CVEs?: The pimcore products with the most published CVEs are pimcore, pimcore/pimcore, admin_classic_bundle, admin-ui-classic-bundle, customer-data-framework.
What are the most common weakness types in pimcore CVEs?: pimcore's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-284 (Improper Access Control), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).
Are there public exploits for pimcore vulnerabilities?: Yes — 87 of pimcore's CVEs have a known public exploit.
How many critical pimcore vulnerabilities are there?: pimcore has 6 critical and 58 high-severity CVEs.
What is the average severity of pimcore CVEs?: The average CVSS base score across pimcore's scored CVEs is 6.6.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track pimcore vulnerabilities

Monitor new pimcore vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing