CVE-2026-22242

CVE-2026-22242 describes a blind SQL injection vulnerability in CoreShop, an eCommerce solution for Pimcore, affecting versions prior to 4.1.8. An authenticated administrator can exploit this to extract confidential database contents using boolean or time-based techniques. The vulnerability has a CVSS score of 4.9 (Medium), indicating a network-based attack with low complexity, requiring high privileges, and resulting in high confidentiality impact but no integrity or availability impact due to the read-only database account. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting low current threat activity.