Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-v9ts-sd7r-gff2
Vulnerability ID VCID-v9ts-sd7r-gff2
Aliases CVE-2022-0704
GHSA-pc32-x737-74cv
Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00034 https://api.first.org/data/v1/epss?cve=CVE-2022-0704
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-pc32-x737-74cv
cvssv3.1 5.4 https://github.com/pimcore/pimcore
generic_textual MODERATE https://github.com/pimcore/pimcore
cvssv3.1 5.4 https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9
generic_textual MODERATE https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9
cvssv3.1 5.4 https://github.com/pimcore/pimcore/pull/11447
generic_textual MODERATE https://github.com/pimcore/pimcore/pull/11447
cvssv3.1 5.4 https://huntr.dev/bounties/4142a8b4-b439-4328-aaa3-52f6fedfd0a6
generic_textual MODERATE https://huntr.dev/bounties/4142a8b4-b439-4328-aaa3-52f6fedfd0a6
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2022-0704
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2022-0704
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2022-0704
https://github.com/pimcore/pimcore
https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9
https://github.com/pimcore/pimcore/pull/11447
https://huntr.dev/bounties/4142a8b4-b439-4328-aaa3-52f6fedfd0a6
CVE-2022-0704 https://nvd.nist.gov/vuln/detail/CVE-2022-0704
GHSA-pc32-x737-74cv https://github.com/advisories/GHSA-pc32-x737-74cv
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/pimcore/pimcore
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/pimcore/pimcore/pull/11447
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://huntr.dev/bounties/4142a8b4-b439-4328-aaa3-52f6fedfd0a6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-0704
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.10565
EPSS Score 0.00034
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:57:25.754409+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/pimcore/pimcore/CVE-2022-0704.yml 38.6.0