https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T01:22:03.642497+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-12129 cnvd-2025-12129 2026-10-07T01:22:03.691920+00:00 cnvd-2025-12129 https://cve.radiocsirt.org/vuln/euvd-2026-212169 EUVD-2026-212169 2026-10-07T01:22:03.691959+00:00 EUVD-2026-212169 https://cve.radiocsirt.org/vuln/fkie_cve-2024-11956 fkie_cve-2024-11956 2026-10-07T01:22:03.691974+00:00

A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument filterDefinition/filter leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component.

 https://cve.radiocsirt.org/vuln/ghsa-q53r-9hh9-w277 GHSA-q53r-9hh9-w277 — pimcore/customer-data-framework vulnerable to SQL Injection 2026-10-07T01:22:03.692006+00:00

Affected: Packagist: pimcore/customer-management-framework-bundle

An SQL injection vulnerability allows any authenticated user to execute arbitrary SQL commands on the server. This can lead to unauthorized access to sensitive data, data modification, or even complete control over the server.

Details The vulnerability is found in the URL parameters of the following endpoint:

`GET /admin/customermanagementframework/customers/list?add-new-customer=1&apply-segment-selection=Apply&filterDefinition[allowedRoleIds][]=1&filterDefinition[allowedUserIds][]=2&filterDefinition[id]=0&filterDefinition[name]=RDFYjolf&filterDefinition[readOnly]=on&filterDefinition[shortcutAvailable]=on&filter[active]=1&filter[email]=testing%40example.com&filter[firstname]=RDFYjolf&filter[id]=1&filter[lastname]=RDFYjolf&filter[operator-customer]=AND&filter[operator-segments]=%40%40dz1Uu&filter[search]=the&filter[segments][832][]=847&filter[segments][833][]=835&filter[segments][874][]=876&filter[showSegments][]=832 HTTP/1.1`

The parameters filterDefinition and filter are vulnerable to SQL injection. When a specially crafted input is provided, it results in an SQL error, indicating that the input is being directly used in an SQL query without proper sanitization.

PoC To reproduce the vulnerability, follow these steps:

Open a web browser or a tool like curl or Postman. Authenticate with valid user credentials. Navigate to the following URL with the vulnerable parameters: ``` https://demo.pimcore.fun/admin/customermanagementframework/customers/list?add-new-customer=1&appl…