https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 02:33:31 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-44741 <p>Pimcore&#39;s Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore&#39;s translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versiosn 2.3.6 and 1.7.18 fix the issue.</p> <p>Pimcore&#39;s Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore&#39;s translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versiosn 2.3.6 and 1.7.18 fix the issue.</p> https://db.gcve.eu/vuln/fkie_cve-2026-44741 https://db.gcve.eu/vuln/ghsa-h4ph-crvj-9h92 <p><strong>Affected:</strong> Packagist: pimcore/admin-ui-classic-bundle</p> <p># GitHub Security Advisory Draft — GM-369</p> <p>## Summary SQL injection in Pimcore&#39;s translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation.</p> <p>## Severity CVSS 3.1: 8.8 (High) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</p> <p>## Affected Component - **Package:** `pimcore/admin-ui-classic-bundle` - **File:** `src/Controller/Admin/TranslationController.php` - **Lines:** 565 (input), 569 (inadequate sanitization), 593 (injection point) - **Endpoint:** `POST /admin/translation/translations`</p> <p>## Description The translation grid endpoint processes JSON filter parameters. When a filter has `type: &#34;date&#34;`, the `property` field is extracted and used to construct a SQL expression:</p> <p>```php $fieldname = $filter[$propertyField]; // Line 565 — user input $fieldname = str_replace(&#39;--&#39;, &#39;&#39;, $fieldname); // Line 569 — trivially bypassable $fieldname = $tableName . &#39;.&#39; . $fieldname; // Line 577 $fieldname = &#34;UNIX_TIMESTAMP(DATE(FROM_UNIXTIME({$fieldname})))&#34;; // Line 593 — injection ```</p> <p>The `str_replace(&#39;--&#39;, &#39;&#39;)` sanitization is trivially bypassable (use `/**/` comments or `----`). In non-language mode, `$fieldname` is concatenated directly into the SQL condition without quoting or parameterization.</p> <p>## Impact Authenticated user with translations view permission can extract arbitrary database data via UNION-based o…</p> <p><strong>Affected:</strong> Packagist: pimcore/admin-ui-classic-bundle</p> <p># GitHub Security Advisory Draft — GM-369</p> <p>## Summary SQL injection in Pimcore&#39;s translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation.</p> <p>## Severity CVSS 3.1: 8.8 (High) — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</p> <p>## Affected Component - **Package:** `pimcore/admin-ui-classic-bundle` - **File:** `src/Controller/Admin/TranslationController.php` - **Lines:** 565 (input), 569 (inadequate sanitization), 593 (injection point) - **Endpoint:** `POST /admin/translation/translations`</p> <p>## Description The translation grid endpoint processes JSON filter parameters. When a filter has `type: &#34;date&#34;`, the `property` field is extracted and used to construct a SQL expression:</p> <p>```php $fieldname = $filter[$propertyField]; // Line 565 — user input $fieldname = str_replace(&#39;--&#39;, &#39;&#39;, $fieldname); // Line 569 — trivially bypassable $fieldname = $tableName . &#39;.&#39; . $fieldname; // Line 577 $fieldname = &#34;UNIX_TIMESTAMP(DATE(FROM_UNIXTIME({$fieldname})))&#34;; // Line 593 — injection ```</p> <p>The `str_replace(&#39;--&#39;, &#39;&#39;)` sanitization is trivially bypassable (use `/**/` comments or `----`). In non-language mode, `$fieldname` is concatenated directly into the SQL condition without quoting or parameterization.</p> <p>## Impact Authenticated user with translations view permission can extract arbitrary database data via UNION-based o…</p> https://db.gcve.eu/vuln/ghsa-h4ph-crvj-9h92