Pimcore EUVD-2026-25909

| CVE-2026-5394 HIGH

SQL Injection (CWE-89)

2026-04-27 Fluid Attacks

GHSA-c8g3-x47w-8q7p

GHSA-r2f4-ff2p-xc64

7.0

CVSS 4.0 · NVD

Share

Severity by source

NVD PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

X

Lifecycle Timeline

3

CVSS changed

Apr 27, 2026 - 20:22 NVD

7.0 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 20:00 euvd

EUVD-2026-25909

CVE Published

Apr 27, 2026 - 19:15 nvd

HIGH 7.0

DescriptionCVE.org

An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.

This issue affects pimcore: 12.3.3.

Analysis

An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.

This issue affects pimcore: 12.3.3.

More in Pimcore

View all

CVE-2019-10867 HIGH Act Now POC

An issue was discovered in Pimcore before 5.7.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploita

CVE-2021-4139 CRITICAL Act Now POC

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rated cri

CVE-2026-23492 HIGH This Week POC

Blind SQL injection in Pimcore's Admin Search Find API allows authenticated attackers to extract database information th

CVE-2023-47637 HIGH This Week POC

Pimcore is an Open Source Data & Experience Management Platform. Rated high severity (CVSS 8.8), this vulnerability is r

CVE-2023-2984 HIGH This Week POC

Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22. Rated high severity (CVSS 8.8), th

CVE-2023-2983 HIGH This Week POC

Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23. Rated high severity (CVSS 8

CVE-2023-2338 HIGH This Week POC

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21. Rated high severity (CVSS 8.8), this vulnerability

CVE-2023-1578 HIGH This Week POC

SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19. Rated high severity (CVSS 8.8), this vulnerability

CVE-2023-25240 HIGH This Week POC

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. Rated high

CVE-2021-23405 HIGH This Week POC

This affects the package pimcore/pimcore before 10.0.7. Rated high severity (CVSS 8.8), this vulnerability is remotely e

CVE-2018-14057 HIGH This Week POC

Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validati

CVE-2024-49370 HIGH This Week POC

Pimcore is an open source data and experience management platform. Rated high severity (CVSS 8.7), this vulnerability is

Same weakness CWE-89 – SQL Injection

View all

CVE-2023-48788 CRITICAL POC

CVE-2025-57819 CRITICAL POC

CVE-2017-8917 CRITICAL POC

CVE-2024-27956 CRITICAL POC

CVE-2014-3704 HIGH POC

CVE-2016-2555 CRITICAL POC

CVE-2016-8582 CRITICAL POC

CVE-2015-7297 HIGH POC

Same technique SQLi

View all

CVE-2025-57819 CRITICAL POC

CVE-2017-8917 CRITICAL POC

CVE-2024-27956 CRITICAL POC

CVE-2014-3704 HIGH POC

CVE-2016-2555 CRITICAL POC

CVE-2016-8582 CRITICAL POC

CVE-2013-0333 HIGH POC

CVE-2015-7297 HIGH POC

Share

EUVD-2026-25909 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy