pimcore admin-ui-classic-bundle vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Latest pimcore admin-ui-classic-bundle vulnerabilities

CVE-2026-23495 — Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing (CVSS 4.3)
CVE-2025-30166 — Pimcore's Admin Classic Bundle allows HTML Injection (CVSS 4.8)
CVE-2025-24980 — Pimcore Admin Classic Bundle allows user enumeration (CVSS 5.3)
CVE-2024-41109 — Pimcore vulnerable to disclosure of system and database information behind /admin firewall (CVSS 6.5)
CVE-2024-25625 — Pimcore Host Header Injection in user invitation link (CVSS 9.3)
CVE-2024-24822 — Pimcore Admin Classic Bundle permissions are not getting checked when working with tags (CVSS 9.1)
CVE-2024-23646 — Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip (CVSS 8.8)
CVE-2024-23648 — Pimcore Admin Classic Bundle host header injection in the password reset (CVSS 8.8)
CVE-2023-49075 — Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls (CVSS 7.2)
CVE-2023-47636 — Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle (CVSS 5.3)
CVE-2023-46722 — Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews (CVSS 6.1)
CVE-2023-5844 — Unverified Password Change in pimcore/admin-ui-classic-bundle (CVSS 7.2)
CVE-2023-42817 — Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations (CVSS 5.4)
CVE-2023-37280 — Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page (CVSS 6.1)