Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

pimcore/admin-ui-classic-bundle

15 known vulnerabilities (5 high, 9 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
15 · 5 high, 9 medium, 1 low
Registry
Packagist

Advisories 15

  • Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

    Affected: from 2.0.0-RC1, fixed in 2.3.6; fixed in 1.7.18.

  • CVE-2026-23495Medium 4.3

    Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing

    Affected: from 2.0.0-RC1, fixed in 2.2.3; fixed in 1.7.16.

  • Pimcore's Admin Classic Bundle allows HTML Injection

    Affected: fixed in 1.7.6.

  • CVE-2025-24980Medium 6.9

    Pimcore Admin Classic Bundle allows user enumeration

    Affected: fixed in 1.7.4.

  • CVE-2024-41109Medium 6.3

    Pimcore vulnerable to disclosure of system and database information behind /admin firewall

    Affected: fixed in 1.5.2.

  • Pimcore Host Header Injection in user invitation link

    Affected: fixed in 1.3.4.

  • CVE-2024-24822Medium 6.5

    Pimcore Admin Classic Bundle permissions are not getting checked when working with tags

    Affected: fixed in 1.3.3.

  • Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

    Affected: from 1.0.0, fixed in 1.3.2.

  • Pimcore Admin Classic Bundle host header injection in the password reset

    Affected: fixed in 1.2.3.

  • Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

    Affected: fixed in 1.2.2.

  • CVE-2023-47636Medium 5.3

    Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle

    Affected: fixed in 1.2.1.

  • CVE-2023-46722Medium 6.1

    Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews

    Affected: fixed in 1.2.0.

  • CVE-2023-5844Medium 4.3

    Unverified Password Change in pimcore/admin-ui-classic-bundle

    Affected: fixed in 1.2.0-RC1.

  • CVE-2023-42817Medium 5.4

    Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations

    Affected: fixed in 1.1.2.

  • CVE-2023-37280Medium 5.0

    Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page

    Affected: fixed in 1.0.3.