CVE-2023-5192

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Excessive Data Query Operations in a Large Data Table in GitHub repository pimcore/demo prior to 10.3.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-1049

Affected software

Vendor	Product	Versions
pimcore	pimcore/demo	>= unspecified, < 10.3.0
pimcore	pimcore	< 10.3.0

References

https://github.com/pimcore/demo/commit/a2a7ff3b565882aefb759804aac4a51afb458f1fPatch
https://huntr.dev/bounties/65c954f2-79c3-4672-8846-a3035e7a1db7Exploit, Third Party Advisory
https://github.com/pimcore/demo/commit/a2a7ff3b565882aefb759804aac4a51afb458f1fPatch
https://huntr.dev/bounties/65c954f2-79c3-4672-8846-a3035e7a1db7Exploit, Third Party Advisory

Timeline

Published: Sep 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-519249.8An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05 allows attackers to execute CVE-2023-519259.8An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allo CVE-2023-519267.5YonBIP v3_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher com CVE-2023-519279.8YonBIP v3_23.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScri CVE-2023-519289.8An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05 allo CVE-2023-51932.7Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage channels to r CVE-2023-519317.5An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.CVE-2023-519398.8An issue in the cp_bbs_sig function in relic/src/cp/relic_cp_bbs.c of Relic relic-toolkit 0.6.0 allows a remote attacker to obtain sensitive CVE-2023-51944.3Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deact CVE-2023-519466.1Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to CVE-2023-519479.1Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types CVE-2023-519487.5A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files host