CVE-2018-14059

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.

• CWE-79

• http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Aug/13Exploit, Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/45208/Exploit, Third Party Advisory, VDB Entry
• https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Aug/13Exploit, Mailing List, Third Party Advisory
• https://www.exploit-db.com/exploits/45208/Exploit, Third Party Advisory, VDB Entry
• https://www.sec-consult.com/en/blog/advisories/sql-injection-xss-csrf-vulnerabilities-in-pimcore-software/Exploit, Third Party Advisory

Published

Aug 24, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-14052An issue has been found in libwav through 2017-04-20. It is …
• CVE-2018-14054A double free exists in the MP4StringProperty class in mp4pr…
• CVE-2018-14055ZNC before 1.7.1-rc1 does not properly validate untrusted li…
• CVE-2018-14056ZNC before 1.7.1-rc1 is prone to a path traversal flaw via .…
• CVE-2018-14057Pimcore before 5.3.0 allows remote attackers to conduct cros…
• CVE-2018-14058Pimcore before 5.3.0 allows SQL Injection via the REST web s…
• CVE-2018-14060OS command injection in the AP mode settings feature in /cgi…
• CVE-2018-14062The COSPAS-SARSAT protocol allows remote attackers to forge …
• CVE-2018-14063The increaseApproval function of a smart contract implementa…
• CVE-2018-14064The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera d…
• CVE-2018-14065XMLReader.php in PHPOffice Common before 0.2.9 allows XXE.
• CVE-2018-14066The content://wappush content provider in com.android.provid…