CVE-2026-72562CWE-89sql-injection

CVE-2026-72562

High · published August 11, 2026

CVSS v3.1

8.8

EPSS

Percentile

36.2

In the wild

Unconfirmed

What it is

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00430 · 36.2th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2026-08-11T16:17Z

References (1)

https://github.com/pimcore/admin-ui-classic-bundle · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

EPSS history

Timeline

11 AUG 11:13Z
Pimcore pimcore admin-ui-classic-bundle - SQL Injection
cvelistv5