Login Request a demo
AC
Product
Admin Classic Bundle
by Pimcore · last CVE Jan 15, 2026
14
CVEs
0
On KEV
9.3
Max CVSS
0
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 2High 4Medium 8Low 0
Severity
All severities14Critical2High4Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Admin Classic Bundle to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-25625
9.3
1%
Feb 19
Pimcore Host Header Injection in user invitation link
Affected: before 1.3.4
CVE-2024-24822
9.1
1%
Feb 7
Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
Affected: before 1.3.3
CVE-2024-23646
8.8
1%
Jan 24
Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
Affected: 1.0.0 before 1.3.2
CVE-2024-23648
8.8
1%
Jan 24
Pimcore Admin Classic Bundle host header injection in the password reset
Affected: before 1.2.3
CVE-2023-49075
7.2
1%
Nov 28
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
Affected: before 1.2.2
CVE-2023-5844
7.2
1%
Oct 30
Unverified Password Change in pimcore/admin-ui-classic-bundle
Affected: through 1.1.4
CVE-2024-41109
6.5
0%
Jul 30
Pimcore vulnerable to disclosure of system and database information behind /admin firewall
Affected: before 1.3.10; 1.4.0 before 1.4.6; 1.5.0 before 1.5.2
CVE-2023-46722
6.1
0%
Oct 31
Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews
Affected: before 1.2.0
CVE-2023-37280
6.1
1%
Jul 11
Pimcore admin UI vulnerable to Cross-site Scripting in two factor authentication setup page
Affected: before 1.0.3
CVE-2023-42817
5.4
0%
Sep 25
Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translations
Affected: before 1.1.2
CVE-2025-24980
5.3
1%
Feb 7
Pimcore Admin Classic Bundle allows user enumeration
Affected: before 1.7.4.1
CVE-2023-47636
5.3
1%
Nov 15
Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle
Affected: before 1.2.1
CVE-2025-30166
4.8
0%
Apr 8
Pimcore's Admin Classic Bundle allows HTML Injection
Affected: before 1.7.6
CVE-2026-23495
4.3
0%
Jan 15
Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing
Affected: before 1.7.16; 2.0.0 before 2.2.3
Showing 14