pimcore

Records172All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high62CVSS 7.0–8.9

Exploited now

pimcore records in CISA KEV

No pimcore vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pimcore 127 records HIGH Admin Classic Bundle 14 records HIGH Customer Management Framework 9 records HIGH Core 1 record MEDIUM Data-hub 1 record LOW E-commerce Framework 1 record LOW Perspective Editor 1 record LOW Web2print Tools 1 record MEDIUM

Records

14 records in Admin Classic Bundle · all components

TI-2024-15667 CVE-2024-23648 · GHSA-mrqg-mwh7-q94j

Pimcore Admin Classic Bundle host header injection in the password reset

HIGH 77

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00827 Published 2024-01-24 Fixed in 1.2.3 CWE-74

TI-2024-16853 CVE-2024-25625 · GHSA-3qpq-6w89-f7mx

Pimcore Host Header Injection in user invitation link

HIGH 75

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00682 Published 2024-02-19 Fixed in 1.3.4 CWE-74

TI-2024-15665 CVE-2024-23646 · GHSA-cwx6-4wmf-c6xv

Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

HIGH 73

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00997 Published 2024-01-24 Fixed in 1.3.2 CWE-89

TI-2025-18658 CVE-2025-24980 · GHSA-vr5f-php7-rg24

Pimcore Admin Classic Bundle allows user enumeration

HIGH 70

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00519 Published 2025-02-07 Fixed in 1.7.4 CWE-204

TI-2023-05380 CVE-2023-5844 · GHSA-6f58-j323-6472

Unverified Password Change in pimcore/admin-ui-classic-bundle

HIGH 65

Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00668 Published 2023-10-30 Fixed in 1.2.0, 1.2.0-RC1 CWE-620

TI-2023-25777 CVE-2023-47636 · GHSA-c8hj-w239-5gvf

Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle

MEDIUM 63

The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00654 Published 2023-11-15 Fixed in 1.2.1 CWE-209

TI-2024-27461 CVE-2024-41109 · GHSA-fx6j-9pp6-ph36

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

MEDIUM 62

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00483 Published 2024-07-30 Fixed in 1.5.2 CWE-200

TI-2026-18928 CVE-2026-23495 · GHSA-hqrp-m84v-2m2f

Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing

MEDIUM 53

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0036 Published 2026-01-15 Fixed in 2.2.3, 1.7.16 CWE-284

TI-2025-21505 CVE-2025-30166 · GHSA-x82r-6j37-vrgg

Pimcore's Admin Classic Bundle allows HTML Injection

MEDIUM 43

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 4.0LOW 1.8 Network High privileges User interaction EPSS 0.00258 Published 2025-04-08 Fixed in 1.7.6 CWE-79

TI-2024-16339 CVE-2024-24822 · GHSA-3rfr-mpfj-2jwq

Pimcore Admin Classic Bundle permissions are not getting checked when working with tags

MEDIUM 40

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00544 Published 2024-02-07 Fixed in 1.3.3 CWE-862

TI-2023-26740 CVE-2023-49075 · GHSA-9wwg-r3c7-4vfg

Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

MEDIUM 40

The Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1HIGH 8.5 Network High privileges User interaction EPSS 0.01437 Published 2023-11-28 Fixed in 1.2.2 CWE-308

TI-2023-25205 CVE-2023-46722 · GHSA-jfxw-6c5v-c42f

Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews

LOW 28

The Pimcore Admin Classic Bundle provides a backend UI for Pimcore.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00593 Published 2023-10-31 Fixed in 1.2.0 CWE-79

TI-2023-18910 CVE-2023-37280 · GHSA-hqv9-6jqw-9g8m

Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page

LOW 28

Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00578 Published 2023-07-11 Fixed in 1.0.3 CWE-79

TI-2023-22908 CVE-2023-42817 · GHSA-m988-7375-7g2c

Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations

LOW 25

Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00381 Published 2023-09-25 Fixed in 1.1.2 CWE-79

Open these records in search →

Critical	8
High	62
Medium	101
Low	1
No CVSS	0