CVE-2025-24980

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version 1.7.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-204

Affected software

No affected versions have been published.

Timeline

Published
Feb 7, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-249819.3MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. In affected versions unsafe parsing logiCVE-2025-249824.3Cross-site request forgery vulnerability exists in Activity Log WinterLock versions prior to 1.2.5. If a user views a malicious page while lCVE-2025-249837.0Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.CVE-2025-249844.6Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attCVE-2025-249857.8Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally.CVE-2025-249866.5Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.CVE-2025-249876.8Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.CVE-2025-249886.8Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.CVE-2025-249899.8An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypCVE-2025-24995.4Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can eCVE-2025-249907.8Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. TCVE-2025-249915.5Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.
CVE-2025-24980: Medium severity, CVSS 5.3 | Vulnix