CVE-2026-72562

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.

• CWE-89

• https://github.com/pimcore/admin-ui-classic-bundle

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72557An unrestricted file upload vulnerability in Cockpit CMS 2.6…8.8
• CVE-2026-72558An SQL injection vulnerability in CiviCRM through 6.18.alpha…8.8
• CVE-2026-72559A stored cross-site scripting vulnerability in HortusFox 5.9…5.4
• CVE-2026-7256** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerab…8.8
• CVE-2026-72560A server-side request forgery vulnerability in HumanSignal L…6.5
• CVE-2026-72561A broken access control vulnerability in Peppermint Lab Pepp…8.8
• CVE-2026-72563A broken access control vulnerability in BadChoice Handesk a…8.1
• CVE-2026-72564An improper authorization vulnerability in fosrl/pangolin th…9.6
• CVE-2026-72565A SQL injection vulnerability in Tencent APIJSON through 8.1…9.8
• CVE-2026-72566A server-side request forgery (SSRF) vulnerability in automa…7.7
• CVE-2026-72567An improper path validation vulnerability in AsyncFuncAI/dee…9.8
• CVE-2026-72568An out-of-bounds read vulnerability in Redis through 8.8.1 a…7.1