CVE-2026-44741Proof of concept (PoC) published · CISA
Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter
CVSS score
8.8
EPSS probability
%0.5
Risk score
0.0
Published
2 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.9
CVE-2026-55634
Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
P
Patch verifiedEPSS %1
9.3
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column
P
Patch verifiedEPSS %1
8.8
CVE-2026-55416
Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization
P
Patch verifiedEPSS %1
8.8
CVE-2026-72562
Pimcore pimcore admin-ui-classic-bundle - SQL Injection
P
Patch status unknownEPSS %0
8.5
CVE-2026-55072
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
P
Patch verifiedEPSS %0
5.1
CVE-2026-109392
Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
P
Patch status unknownEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-44741"