https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T08:09:57.324946+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-211390 EUVD-2026-211390 2026-10-08T08:09:57.327570+00:00 EUVD-2026-211390 https://cve.radiocsirt.org/vuln/fkie_cve-2023-2756 fkie_cve-2023-2756 2026-10-08T08:09:57.327601+00:00

SQL Injection in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

 https://cve.radiocsirt.org/vuln/ghsa-25fx-3c2q-cq46 GHSA-25fx-3c2q-cq46 — pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query 2026-10-08T08:09:57.327630+00:00

Affected: Packagist: pimcore/customer-management-framework-bundle

### Impact An administrator user can use the inheritable segments feature to execute his own blind SQL queries.

A user with administrator privileges can run any SQL query on database. This can be used to retrieve sensitive data, change database information or any other malicious activity against the database.

### Patches Update to version 3.3.10 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch

### Workarounds Apply https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch manually.

### References https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44/

 https://cve.radiocsirt.org/vuln/gsd-2023-2756 gsd-2023-2756 2026-10-08T08:09:57.327661+00:00 gsd-2023-2756