pimcore is vulnerable to cross-site scripting via "title field " in data objects

Mô tả

Login with dev account https://11.x-dev.pimcore.fun/admin/?_dc=1670962076&perspective=

Go to setting --> data objects --> classes --> events

Click media under genaral settings

Add payload in title field.

Go to data objects module and open events, xss will trigger

// PoC.js "><iMg SrC="x" oNeRRor="alert(xss);">

Tham khảo

• pimcore/pimcore security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2023-0323 · ADVISORY
• pimcore/pimcore#13916.patch · WEB
• pimcore/pimcore commit 746fac1 · WEB
• pimcore/pimcore · PACKAGE
• huntr.dev/bounties/129d6a4b-0504-4de1-a72c-3f12c4552343 · WEB

Lỗ hổng khác của pimcore/pimcore

• CVE-2026-55416CAO 8.8Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports…
• CVE-2026-55072CAO 8.5Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can su…
• CVE-2026-55634NGHIÊM TRỌNG 9.9Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, the class-definition import endpoi…
• CVE-2026-55220NGHIÊM TRỌNG 9.3Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, Pimcore\Model\DataObject\ClassDefi…
• CVE-2026-45704CAO 7.1Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authoriz…