Security Advisory

CVE-2026-5394

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-04-27 19:15:04

Last updated 2026-05-05 17:17:45

Assigner Fluid Attacks

CVSS score 7.0

State PUBLISHED

Description

An authenticated administrative user who can import or save DataObject class definitions can inject attacker-controlled composite index metadata and trigger unintended SQL execution in the backend. This issue affects pimcore: 12.3.3.

← Browse all CVEs View on cve.org ↗