# pimcore/admin-ui-classic-bundle (Packagist) vulnerabilities

15 known vulnerabilities (5 high, 9 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/pimcore/admin-ui-classic-bundle

## Advisories (15)

### [CVE-2026-44741](https://cve.now/CVE-2026-44741): Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter

- Severity: High 8.8
- Published: Aug 12, 2026
- Affected: from 2.0.0-RC1, fixed in 2.3.6; fixed in 1.7.18.

### [CVE-2026-23495](https://cve.now/CVE-2026-23495): Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing

- Severity: Medium 4.3
- Published: Jan 15, 2026
- Affected: from 2.0.0-RC1, fixed in 2.2.3; fixed in 1.7.16.

### [CVE-2025-30166](https://cve.now/CVE-2025-30166): Pimcore's Admin Classic Bundle allows HTML Injection

- Severity: Low 1.8
- Published: Apr 8, 2025
- Affected: fixed in 1.7.6.

### [CVE-2025-24980](https://cve.now/CVE-2025-24980): Pimcore Admin Classic Bundle allows user enumeration

- Severity: Medium 6.9
- Published: Feb 7, 2025
- Affected: fixed in 1.7.4.

### [CVE-2024-41109](https://cve.now/CVE-2024-41109): Pimcore vulnerable to disclosure of system and database information behind /admin firewall

- Severity: Medium 6.3
- Published: Jul 30, 2024
- Affected: fixed in 1.5.2.

### [CVE-2024-25625](https://cve.now/CVE-2024-25625): Pimcore Host Header Injection in user invitation link

- Severity: High 8.1
- Published: Feb 19, 2024
- Affected: fixed in 1.3.4.

### [CVE-2024-24822](https://cve.now/CVE-2024-24822): Pimcore Admin Classic Bundle permissions are not getting checked when working with tags

- Severity: Medium 6.5
- Published: Feb 7, 2024
- Affected: fixed in 1.3.3.

### [CVE-2024-23646](https://cve.now/CVE-2024-23646): Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

- Severity: High 8.8
- Published: Jan 24, 2024
- Affected: from 1.0.0, fixed in 1.3.2.

### [CVE-2024-23648](https://cve.now/CVE-2024-23648): Pimcore Admin Classic Bundle host header injection in the password reset

- Severity: High 8.8
- Published: Jan 24, 2024
- Affected: fixed in 1.2.3.

### [CVE-2023-49075](https://cve.now/CVE-2023-49075): Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

- Severity: High 8.5
- Published: Nov 28, 2023
- Affected: fixed in 1.2.2.

### [CVE-2023-47636](https://cve.now/CVE-2023-47636): Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle

- Severity: Medium 5.3
- Published: Nov 15, 2023
- Affected: fixed in 1.2.1.

### [CVE-2023-46722](https://cve.now/CVE-2023-46722): Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews

- Severity: Medium 6.1
- Published: Oct 31, 2023
- Affected: fixed in 1.2.0.

### [CVE-2023-5844](https://cve.now/CVE-2023-5844): Unverified Password Change in pimcore/admin-ui-classic-bundle

- Severity: Medium 4.3
- Published: Oct 30, 2023
- Affected: fixed in 1.2.0-RC1.

### [CVE-2023-42817](https://cve.now/CVE-2023-42817): Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations

- Severity: Medium 5.4
- Published: Sep 25, 2023
- Affected: fixed in 1.1.2.

### [CVE-2023-37280](https://cve.now/CVE-2023-37280): Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page

- Severity: Medium 5.0
- Published: Jul 11, 2023
- Affected: fixed in 1.0.3.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/pimcore/admin-ui-classic-bundle
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.