QwikSec

Security Database

CVE

CWE

Training

CVE-2025-24980

Published: Feb 7, 2025

Modified: Jan 16, 2026

PUBLISHED

Description

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version 1.7.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Vendor	Product	Versions
pimcore	admin-ui-classic-bundle	affected `< 1.7.4`

Weaknesses (CWE)

References

https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-vr5f-php7-rg24

x_refsource_CONFIRM

https://github.com/pimcore/admin-ui-classic-bundle/pull/808

x_refsource_MISC

https://github.com/pimcore/admin-ui-classic-bundle/commit/96ae555578c3b4df368092d71e07a6c4ddf8fbe9

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.