Pimcore

Admin Classic Bundle

14 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2026-23495

Exploit
  • EPSS 0%
  • Veröffentlicht 15.01.2026 16:47:07
  • Zuletzt bearbeitet 30.01.2026 19:51:59

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configu...

4.8

CVE-2025-30166

  • EPSS 0%
  • Veröffentlicht 08.04.2025 11:07:06
  • Zuletzt bearbeitet 04.11.2025 18:45:01

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to sessi...

5.3

CVE-2025-24980

Exploit
  • EPSS 0%
  • Veröffentlicht 07.02.2025 20:15:33
  • Zuletzt bearbeitet 16.01.2026 18:16:06

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been impleme...

6.5

CVE-2024-41109

Exploit
  • EPSS 0.05%
  • Veröffentlicht 30.07.2024 15:15:12
  • Zuletzt bearbeitet 04.11.2025 18:01:13

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and ...

9.3

CVE-2024-25625

Exploit
  • EPSS 0.02%
  • Veröffentlicht 19.02.2024 16:15:52
  • Zuletzt bearbeitet 01.04.2025 15:38:06

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitatio...

9.1

CVE-2024-24822

  • EPSS 0%
  • Veröffentlicht 07.02.2024 18:15:54
  • Zuletzt bearbeitet 21.11.2024 08:59:47

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply...

8.8

CVE-2024-23646

Exploit
  • EPSS 0.14%
  • Veröffentlicht 24.01.2024 20:15:53
  • Zuletzt bearbeitet 21.11.2024 08:58:04

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter `selectedIds` is susceptible to SQL I...

8.8

CVE-2024-23648

Exploit
  • EPSS 0.02%
  • Veröffentlicht 24.01.2024 18:15:08
  • Zuletzt bearbeitet 21.11.2024 08:58:05

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, ...

7.2

CVE-2023-49075

  • EPSS 0.01%
  • Veröffentlicht 28.11.2023 05:15:08
  • Zuletzt bearbeitet 21.11.2024 08:32:46

The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system...

5.3

CVE-2023-47636

Exploit
  • EPSS 0.01%
  • Veröffentlicht 15.11.2023 20:15:07
  • Zuletzt bearbeitet 21.11.2024 08:30:34

The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file...