CVE-2019-10763

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
n/apimcore/pimcoreAll versions prior to version 3.6.0

References

Timeline

Published
Nov 18, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-107647.4In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private keCVE-2019-107659.8iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.CVE-2019-107669.8Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.CVE-2019-107677.5An attacker can include file contents from outside the `/adapter/xxx/` directory, where `xxx` is the name of an existent adapter like "adminCVE-2019-107687.5In AngularJS before 1.7.9 the function `merge()` could be tricked into adding or modifying properties of `Object.prototype` using a `__protoCVE-2019-107699.8safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. Affected versions of this package are vulnerCVE-2019-10775.0An elevation of privilege vulnerability exists when the Visual Studio updater service improperly handles file permissions, aka 'Visual StudiCVE-2019-107706.1All versions of io.ratpack:ratpack-core from 0.9.10 inclusive and before 1.7.6 are vulnerable to Cross-site Scripting (XSS). This affects thCVE-2019-107716.1Characters in the GET url path are not properly escaped and can be reflected in the server response.CVE-2019-107726.1It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by CVE-2019-107737.8In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using speciaCVE-2019-107749.8php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code executio