Vulnerabilities

TI-2026-18928 CVE-2026-23495 · GHSA-hqrp-m84v-2m2f

Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing

MEDIUM 53

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0036 Published 2026-01-15 Fixed in 2.2.3, 1.7.16 CWE-284

TI-2025-21505 CVE-2025-30166 · GHSA-x82r-6j37-vrgg

Pimcore's Admin Classic Bundle allows HTML Injection

MEDIUM 43

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 4.0LOW 1.8 Network High privileges User interaction EPSS 0.00258 Published 2025-04-08 Fixed in 1.7.6 CWE-79

TI-2025-18658 CVE-2025-24980 · GHSA-vr5f-php7-rg24

Pimcore Admin Classic Bundle allows user enumeration

HIGH 70

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00519 Published 2025-02-07 Fixed in 1.7.4 CWE-204

TI-2024-27461 CVE-2024-41109 · GHSA-fx6j-9pp6-ph36

Pimcore vulnerable to disclosure of system and database information behind /admin firewall

MEDIUM 62

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00483 Published 2024-07-30 Fixed in 1.5.2 CWE-200

TI-2024-16853 CVE-2024-25625 · GHSA-3qpq-6w89-f7mx

Pimcore Host Header Injection in user invitation link

HIGH 75

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00682 Published 2024-02-19 Fixed in 1.3.4 CWE-74

TI-2024-16339 CVE-2024-24822 · GHSA-3rfr-mpfj-2jwq

Pimcore Admin Classic Bundle permissions are not getting checked when working with tags

MEDIUM 40

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00544 Published 2024-02-07 Fixed in 1.3.3 CWE-862

TI-2024-15665 CVE-2024-23646 · GHSA-cwx6-4wmf-c6xv

Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

HIGH 73

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00997 Published 2024-01-24 Fixed in 1.3.2 CWE-89

TI-2024-15667 CVE-2024-23648 · GHSA-mrqg-mwh7-q94j

Pimcore Admin Classic Bundle host header injection in the password reset

HIGH 77

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00827 Published 2024-01-24 Fixed in 1.2.3 CWE-74

TI-2023-26740 CVE-2023-49075 · GHSA-9wwg-r3c7-4vfg

Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

MEDIUM 40

The Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1HIGH 8.5 Network High privileges User interaction EPSS 0.01437 Published 2023-11-28 Fixed in 1.2.2 CWE-308

TI-2023-25777 CVE-2023-47636 · GHSA-c8hj-w239-5gvf

Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle

MEDIUM 63

The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00654 Published 2023-11-15 Fixed in 1.2.1 CWE-209

TI-2023-25205 CVE-2023-46722 · GHSA-jfxw-6c5v-c42f

Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews

LOW 28

The Pimcore Admin Classic Bundle provides a backend UI for Pimcore.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00593 Published 2023-10-31 Fixed in 1.2.0 CWE-79

TI-2023-05380 CVE-2023-5844 · GHSA-6f58-j323-6472

Unverified Password Change in pimcore/admin-ui-classic-bundle

HIGH 65

Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00668 Published 2023-10-30 Fixed in 1.2.0, 1.2.0-RC1 CWE-620

TI-2023-22908 CVE-2023-42817 · GHSA-m988-7375-7g2c

Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations

LOW 25

Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00381 Published 2023-09-25 Fixed in 1.1.2 CWE-79

TI-2023-18910 CVE-2023-37280 · GHSA-hqv9-6jqw-9g8m

Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page

LOW 28

Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00578 Published 2023-07-11 Fixed in 1.0.3 CWE-79

Vulnerabilities

Filters