{"api_version":"1","generated_at":"2026-08-21T02:22:31+00:00","cve":"CVE-2026-72562","urls":{"html":"https://cve.report/CVE-2026-72562","api":"https://cve.report/api/cve/CVE-2026-72562.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72562","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72562"},"summary":{"title":"Pimcore pimcore admin-ui-classic-bundle - SQL Injection","description":"An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.","state":"PUBLISHED","assigner":"TuranSec","published_at":"2026-08-11 12:17:42","updated_at":"2026-08-11 13:19:03"},"problem_types":["CWE-89","CWE-89 CWE-89: SQL Injection"],"metrics":[{"version":"3.1","source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://github.com/pimcore/admin-ui-classic-bundle","name":"https://github.com/pimcore/admin-ui-classic-bundle","refsource":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72562","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72562","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Pimcore","product":"pimcore admin-ui-classic-bundle","version":"affected 2.3 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Bobur Abdugafforov","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-72562","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-11T12:17:44.841997Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-11T12:17:54.337Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"pimcore admin-ui-classic-bundle","vendor":"Pimcore","versions":[{"lessThanOrEqual":"2.3","status":"affected","version":"0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"Bobur Abdugafforov"}],"descriptions":[{"lang":"en","value":"An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents."}],"metrics":[{"cvssV3_1":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89: SQL Injection","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-11T11:13:02.211Z","orgId":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","shortName":"TuranSec"},"references":[{"name":"Project Repository","url":"https://github.com/pimcore/admin-ui-classic-bundle"}],"title":"Pimcore pimcore admin-ui-classic-bundle - SQL Injection"}},"cveMetadata":{"assignerOrgId":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","assignerShortName":"TuranSec","cveId":"CVE-2026-72562","datePublished":"2026-08-11T11:13:02.211Z","dateReserved":"2026-08-10T10:32:49.082Z","dateUpdated":"2026-08-11T12:17:54.337Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-11 12:17:42","lastModifiedDate":"2026-08-11 13:19:03","problem_types":["CWE-89","CWE-89 CWE-89: SQL Injection"],"metrics":{"cvssMetricV31":[{"source":"309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-11T12:17:44.841997Z","id":"CVE-2026-72562","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72562","Ordinal":"1","Title":"Pimcore pimcore admin-ui-classic-bundle - SQL Injection","CVE":"CVE-2026-72562","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72562","Ordinal":"1","NoteData":"An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id column filter. The filter value is concatenated directly into the SQL WHERE clause without parameterization. An attacker with backend access can exfiltrate or modify all database contents.","Type":"Description","Title":"Pimcore pimcore admin-ui-classic-bundle - SQL Injection"}]}}}