Technology · Packagist
pimcore/admin-ui-classic-bundle (Packagist) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 17 vulnerabilities in pimcore/admin-ui-classic-bundle (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-44741, was published on 27 May 2026.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 0
- Exploited in the wild
- 0
About pimcore/admin-ui-classic-bundle (Packagist)
The pimcore/admin-ui-classic-bundle is a Composer package providing the classic administrative user interface for the Pimcore platform.
Latest pimcore/admin-ui-classic-bundle (Packagist) vulnerabilities
- CVE-2026-44741: Pimcore Admin Classic Bundle SQL injection in translation grid date filterhighCVSS 8.8EPSS 0.5%
- CVE-2026-23495: Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" ListinglowCVSS 3.1EPSS 0.4%
- CVE-2025-30166: Pimcore's Admin Classic Bundle allows HTML InjectionmediumCVSS 4EPSS 0.3%
- CVE-2025-24980: Pimcore Admin Classic Bundle allows user enumerationmediumCVSS 4EPSS 0.5%
- Pimcore includes vulnerable PHPOffice/PhpSpreadsheetlowCVSS 3.1
- CVE-2024-41109: Pimcore vulnerable to disclosure of system and database information behind /admin firewalllowCVSS 3.1EPSS 0.5%
- Vulnerable embedded jQuery Versioninfo
- CVE-2024-25625: Pimcore Host Header Injection in user invitation linklowCVSS 3.1EPSS 0.7%
- CVE-2024-24822: Pimcore Admin Classic Bundle permissions are not getting checked when working with tagslowCVSS 3.1EPSS 0.5%
- CVE-2024-23648: Host header injection in the password resetlowCVSS 3.1EPSS 0.8%
- CVE-2024-23646: SQL Injection in Admin download files as ziplowCVSS 3.1EPSS 1.0%
- CVE-2023-49075: Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewallslowCVSS 3.1EPSS 1.4%
- CVE-2023-47636: pimcore/admin-ui-classic-bundle Full Path Disclosure via re-export documentlowCVSS 3.1EPSS 0.7%
- CVE-2023-46722: Pimcore Admin Classic Bundle Cross-site Scripting (XSS) in PDF previewslowCVSS 3.1EPSS 0.5%
- CVE-2023-5844: pimcore/admin-ui-classic-bundle Unverified Password ChangelowCVSS 3EPSS 0.5%
- CVE-2023-42817: pimcore/admin-ui-classic-bundle Cross-site Scripting vulnerability in TranslationslowCVSS 3.1EPSS 0.4%
- CVE-2023-37280: Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup pagelowCVSS 3.1EPSS 0.6%
Most severe pimcore/admin-ui-classic-bundle (Packagist) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-44741: Pimcore Admin Classic Bundle SQL injection in translation grid date filterhighCVSS 8.8EPSS 0.5%
- CVE-2025-24980: Pimcore Admin Classic Bundle allows user enumerationmediumCVSS 4EPSS 0.5%
- CVE-2025-30166: Pimcore's Admin Classic Bundle allows HTML InjectionmediumCVSS 4EPSS 0.3%
- CVE-2023-49075: Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewallslowCVSS 3.1EPSS 1.4%
- CVE-2024-23646: SQL Injection in Admin download files as ziplowCVSS 3.1EPSS 1.0%
- CVE-2024-23648: Host header injection in the password resetlowCVSS 3.1EPSS 0.8%
- CVE-2024-25625: Pimcore Host Header Injection in user invitation linklowCVSS 3.1EPSS 0.7%
- CVE-2023-47636: pimcore/admin-ui-classic-bundle Full Path Disclosure via re-export documentlowCVSS 3.1EPSS 0.7%
- CVE-2023-37280: Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup pagelowCVSS 3.1EPSS 0.6%
- CVE-2024-24822: Pimcore Admin Classic Bundle permissions are not getting checked when working with tagslowCVSS 3.1EPSS 0.5%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many pimcore/admin-ui-classic-bundle (Packagist) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/pimcore-admin-ui-classic-bundle)<a href="https://junglewise.ai/threats/technologies/pimcore-admin-ui-classic-bundle"><img src="https://junglewise.ai/threats/technologies/pimcore-admin-ui-classic-bundle/badge.svg" alt="pimcore/admin-ui-classic-bundle (Packagist) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/pimcore-admin-ui-classic-bundle.json, and this page as text at https://junglewise.ai/threats/technologies/pimcore-admin-ui-classic-bundle.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "pimcore/admin-ui-classic-bundle (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/pimcore-admin-ui-classic-bundle, 9 November 2026.