Search for packages
| purl | pkg:composer/pimcore/admin-ui-classic-bundle@1.2.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2b8z-rbsm-1fbp
Aliases: GHSA-hq76-662x-7mw4 |
Pimcore includes vulnerable PHPOffice/PhpSpreadsheet |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-31rb-a5d3-3yfb
Aliases: CVE-2025-30166 GHSA-x82r-6j37-vrgg |
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. The vulnerability was discovered in the /admin/email/send-test-email endpoint using the POST method. The vulnerable parameter is content, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible. This vulnerability is fixed in 1.7.6. |
Affected by 1 other vulnerability. |
|
VCID-3n6v-tkmg-ffha
Aliases: CVE-2024-41109 GHSA-fx6j-9pp6-ph36 |
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Navigating to `/admin/index/statistics` with a logged in Pimcore user exposes information about the Pimcore installation, PHP version, MYSQL version, installed bundles and all database tables and their row count in the system. This vulnerability is fixed in 1.5.2, 1.4.6, and 1.3.10. |
Affected by 4 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-6frc-bu9z-p7h4
Aliases: CVE-2024-23648 GHSA-mrqg-mwh7-q94j |
Host header injection in the password reset |
Affected by 9 other vulnerabilities. |
|
VCID-9njs-586x-j3dp
Aliases: CVE-2024-24822 GHSA-3rfr-mpfj-2jwq |
Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. Prior to version 1.3.3, an attacker can create, delete etc. tags without having the permission to do so. A fix is available in version 1.3.3. As a workaround, one may apply the patch manually. |
Affected by 7 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-dqe1-syy1-qqey
Aliases: CVE-2024-23646 GHSA-cwx6-4wmf-c6xv |
SQL Injection in Admin download files as zip |
Affected by 8 other vulnerabilities. Affected by 1 other vulnerability. |
|
VCID-n4gy-64ch-cbhf
Aliases: CVE-2024-25625 GHSA-3qpq-6w89-f7mx |
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkAction` function of the UserController, specifically in the way `$loginUrl` trusts user input. The host header from incoming HTTP requests is used unsafely when generating URLs. An attacker can manipulate the HTTP host header in requests to the /admin/user/invitationlink endpoint, resulting in the generation of URLs with the attacker's domain. In fact, if a host header is injected in the POST request, the $loginURL parameter is constructed with this unvalidated host header. It is then used to send an invitation email to the provided user. This vulnerability can be used to perform phishing attacks by making the URLs in the invitation links emails point to an attacker-controlled domain. Version 1.3.4 contains a patch for the vulnerability. The maintainers recommend validating the host header and ensuring it matches the application's domain. It would also be beneficial to use a default trusted host or hostname if the incoming host header is not recognized or is absent. |
Affected by 6 other vulnerabilities. |
|
VCID-rdf7-crp3-4yet
Aliases: CVE-2026-23495 GHSA-hqrp-m84v-2m2f |
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. The vulnerability is fixed in 2.2.3 and 1.7.16. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-udcm-44p7-a7hm
Aliases: CVE-2025-24980 GHSA-vr5f-php7-rg24 |
pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version 1.7.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability. |
Affected by 2 other vulnerabilities. |
|
VCID-yj22-6bta-77b7
Aliases: GHSA-jmh9-6rjq-gjh9 |
Vulnerable embedded jQuery Version |
Affected by 5 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-1kwu-2agn-e7gf |
CVE-2023-49075
GHSA-9wwg-r3c7-4vfg |