pimcore admin-ui-classic-bundle vulnerabilities

CVEs per yearBy the year they were published

1. 20235
2. 20245
3. 20252

Newest CVEs

• CVE-2025-30166

  Pimcore's Admin Classic Bundle allows HTML Injection

  pimcore · admin-ui-classic-bundle

  Low1.8
• CVE-2025-24980

  Pimcore Admin Classic Bundle allows user enumeration

  pimcore · admin-ui-classic-bundle

  Medium6.9
• CVE-2024-41109

  Pimcore vulnerable to disclosure of system and database information behind /admin firewall

  pimcore · admin-ui-classic-bundle

  Medium6.3
• CVE-2024-25625

  Pimcore Host Header Injection in user invitation link

  pimcore · admin-ui-classic-bundle

  High8.1
• CVE-2024-24822

  Pimcore Admin Classic Bundle permissions are not getting checked when working with tags

  pimcore · admin-ui-classic-bundle

  Medium6.5
• CVE-2024-23646

  Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip

  pimcore · admin-ui-classic-bundle

  High8.8
• CVE-2024-23648

  Pimcore Admin Classic Bundle host header injection in the password reset

  pimcore · admin-ui-classic-bundle

  High8.8
• CVE-2023-49075

  Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls

  pimcore · admin-ui-classic-bundle

  High8.5
• CVE-2023-47636

  Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle

  pimcore · admin-ui-classic-bundle

  Medium5.3
• CVE-2023-46722

  Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews

  pimcore · admin-ui-classic-bundle

  Medium6.1