CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-28106 – Pimcore vulnerable to Cross-site Scripting in UrlSlug Data type
https://notcve.org/view.php?id=CVE-2023-28106
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually. • https://github.com/pimcore/pimcore/commit/c59d0bf1d03a5037b586fe06230694fa3818dbf2 https://github.com/pimcore/pimcore/pull/14669.patch https://github.com/pimcore/pimcore/security/advisories/GHSA-x5j3-mq9g-8jc8 https://huntr.dev/bounties/fa77d780-9b23-404b-8c44-12108881d11a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1429 – Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
https://notcve.org/view.php?id=CVE-2023-1429
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. • https://github.com/pimcore/pimcore/commit/7588c336edb24050656111b89d69e69cc9feb5f5 https://huntr.dev/bounties/e0829fea-e458-47b8-84a3-a74476d9638f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1312 – Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
https://notcve.org/view.php?id=CVE-2023-1312
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. • https://github.com/pimcore/pimcore/commit/d35d0712858f24d0ec96ddfd4cbe82ff4b5a5fbb https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1286 – Cross-site Scripting (XSS) - Stored in pimcore/pimcore
https://notcve.org/view.php?id=CVE-2023-1286
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. • https://github.com/pimcore/pimcore/commit/82cca7f4a7560b160336cce2610481098ca52c18 https://huntr.dev/bounties/31d97442-3f87-439f-83f0-1c7862ef0c7c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1115 – Cross-site Scripting (XSS) - Stored in pimcore/pimcore
https://notcve.org/view.php?id=CVE-2023-1115
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. • https://github.com/pimcore/pimcore/commit/c6368b7cc69a3ebf2c83de7586f492ca1f404dd3 https://huntr.dev/bounties/cfa80332-e4cf-4d64-b3e5-e10298628d17 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •