Composer pimcore/admin-ui-classic-bundle has 17 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-49075 | Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls | high | 8.4 | <1.2.2 | 1.2.2 |
| CVE-2024-23646 | SQL Injection in Admin download files as zip | high | 8.8 | >=1.0.0 and <1.3.2 | 1.3.2 |
| CVE-2024-23648 | Host header injection in the password reset | high | 8.8 | <1.2.3 | 1.2.3 |
| CVE-2024-25625 | Pimcore Host Header Injection in user invitation link | high | 8.1 | <1.3.4 | 1.3.4 |
| CVE-2023-47636 | pimcore/admin-ui-classic-bundle Full Path Disclosure via re-export document | medium | 5.3 | <1.2.1 | 1.2.1 |
| CVE-2023-37280 | Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page | medium | 6.1 | <1.0.3 | 1.0.3 |
| CVE-2023-5844 | pimcore/admin-ui-classic-bundle Unverified Password Change | medium | 4.3 | <1.2.0-RC1 | 1.2.0-RC1 |
| CVE-2024-24822 | Pimcore Admin Classic Bundle permissions are not getting checked when working with tags | medium | 6.5 | <1.3.3 | 1.3.3 |
| CVE-2025-24980 | Pimcore Admin Classic Bundle allows user enumeration | medium | 0.0 | <1.7.4 | 1.7.4 |
| CVE-2026-44741 | Pimcore Admin Classic Bundle Vulnerable to SQL Injection in Translation Grid Date Filter via Unsanitized Property Parameter | high | 8.8 | >=2.0.0-RC1 and <2.3.6 or <1.7.18 | 2.3.6, 1.7.18 |
| CVE-2023-46722 | Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previews | medium | 6.1 | <1.2.0 | 1.2.0 |
| CVE-2024-41109 | Pimcore vulnerable to disclosure of system and database information behind /admin firewall | medium | 6.3 | <1.5.2 | 1.5.2 |
| CVE-2023-42817 | pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in Translations | medium | 5.4 | <1.1.2 | 1.1.2 |
| CVE-2026-23495 | Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing | medium | 4.3 | >=2.0.0-RC1 and <2.2.3 or <1.7.16 | 2.2.3, 1.7.16 |
| CVE-2025-30166 | Pimcore's Admin Classic Bundle allows HTML Injection | low | 0.0 | <1.7.6 | 1.7.6 |
| GHSA-hq76-662x-7mw4 | Pimcore includes vulnerable PHPOffice/PhpSpreadsheet | high | 8.8 | <1.3.11 or >=1.4.0 and <1.4.7 or >=1.5.0 and <1.5.4 | 1.3.11, 1.4.7, 1.5.4 |
| GHSA-jmh9-6rjq-gjh9 | Vulnerable embedded jQuery Version | medium | 0.0 | <1.4.3 | 1.4.3 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked