https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:00:51 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-308604 EUVD-2026-308604 https://cve.radiocsirt.org/vuln/euvd-2026-308604 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5394 <p>An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.</p> <p>This issue affects pimcore: 12.3.3.</p> <p>An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.</p> <p>This issue affects pimcore: 12.3.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-5394 https://cve.radiocsirt.org/vuln/ghsa-r2f4-ff2p-xc64 <p><strong>Affected:</strong> Packagist: pimcore/pimcore</p> <p>My name is Oscar Uribe, Security Researcher at Fluid Attacks. I am reaching out because we have identified a security vulnerability in Pimcore 12.3.3 that we would like to report to you so we can coordinate a responsible disclosure together.</p> <p>As part of our standard disclosure measures, we follow a timeline (outlined at https://fluidattacks.com/advisories/policy), which is aligned with ISO/IEC 29147:2018 and ISO/IEC 30111:2019. In short, the timeline works as follows: we ask for acknowledgment of the report within a few days of your first accessing it, and from there, we are happy to coordinate a joint disclosure date with you, typically within 90 days of the initial discovery. This gives your team reasonable time to assess, develop, and release a fix.</p> <p>We have reserved the CVE ID **&#34;CVE-2026-5394&#34;** for this issue, and the advisory will eventually be published at [https://fluidattacks.com/advisories/dragons](https://fluidattacks.com/advisories/dragons). We are committed to coordinating the timing of that publication with you.</p> <p>Please feel free to reach out if you have any questions about the report, the process, or the timeline. We are glad to work with you on this.</p> <p>## Description An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.</p> <p>The vulnerable flow accepts `compositeIndices` from imported JSON, stores the values without stric…</p> <p><strong>Affected:</strong> Packagist: pimcore/pimcore</p> <p>My name is Oscar Uribe, Security Researcher at Fluid Attacks. I am reaching out because we have identified a security vulnerability in Pimcore 12.3.3 that we would like to report to you so we can coordinate a responsible disclosure together.</p> <p>As part of our standard disclosure measures, we follow a timeline (outlined at https://fluidattacks.com/advisories/policy), which is aligned with ISO/IEC 29147:2018 and ISO/IEC 30111:2019. In short, the timeline works as follows: we ask for acknowledgment of the report within a few days of your first accessing it, and from there, we are happy to coordinate a joint disclosure date with you, typically within 90 days of the initial discovery. This gives your team reasonable time to assess, develop, and release a fix.</p> <p>We have reserved the CVE ID **&#34;CVE-2026-5394&#34;** for this issue, and the advisory will eventually be published at [https://fluidattacks.com/advisories/dragons](https://fluidattacks.com/advisories/dragons). We are committed to coordinating the timing of that publication with you.</p> <p>Please feel free to reach out if you have any questions about the report, the process, or the timeline. We are glad to work with you on this.</p> <p>## Description An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend.</p> <p>The vulnerable flow accepts `compositeIndices` from imported JSON, stores the values without stric…</p> https://cve.radiocsirt.org/vuln/ghsa-r2f4-ff2p-xc64