Pimcore Admin Classic Bundle vulnerabilities

• pimcore admin classic bundle, pimcore +1 more Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing CVE-2026-23495 Fix available 4.3 MediumJanuary 15, 2026
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore's Admin Classic Bundle allows HTML Injection CVE-2025-30166 Fix available 1.8 LowApril 8, 2025
• pimcore admin-ui-classic-bundle, admin classic bundle +1 more Pimcore Admin Classic Bundle allows user enumeration CVE-2025-24980 Fix available 6.9 MediumFebruary 7, 2025
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore vulnerable to disclosure of system and database information behind /admin firewall CVE-2024-41109 Fix available 6.3 MediumJuly 30, 2024
• pimcore admin-ui-classic-bundle, admin classic bundle +1 more Pimcore Host Header Injection in user invitation link CVE-2024-25625 Fix available 8.1 HighFebruary 19, 2024
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin Classic Bundle permissions are not getting checked when working with tags CVE-2024-24822 Fix available 6.5 MediumFebruary 7, 2024
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip CVE-2024-23646 Fix available 8.8 HighJanuary 24, 2024
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin Classic Bundle host header injection in the password reset CVE-2024-23648 Fix available 8.8 HighJanuary 24, 2024
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls CVE-2023-49075 Fix available 8.5 HighNovember 27, 2023
• pimcore admin-ui-classic-bundle, admin classic bundle +1 more Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle CVE-2023-47636 Fix available 5.3 MediumNovember 15, 2023
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews CVE-2023-46722 Fix available 6.1 MediumOctober 31, 2023
• pimcore pimcore/admin-ui-classic-bundle, admin classic bundle +1 more Unverified Password Change in pimcore/admin-ui-classic-bundle CVE-2023-5844 Fix available 4.3 MediumOctober 30, 2023
• pimcore admin-ui-classic-bundle, admin classic bundle +1 more Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations CVE-2023-42817 Fix available 5.4 MediumSeptember 25, 2023
• pimcore admin classic bundle, admin-ui-classic-bundle +1 more Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page CVE-2023-37280 Fix available 5.0 MediumJuly 11, 2023