CVE-2025-30166

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. The vulnerability was discovered in the /admin/email/send-test-email endpoint using the POST method. The vulnerable parameter is content, which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible. This vulnerability is fixed in 1.7.6.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-301677.3Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, CVE-2025-301686.9Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd pa CVE-2025-301696.7File upload and execute vulnerabilities in ASPECT allow PHP script injection if session administrator credentials become compromised. This i CVE-2025-30175.3A vulnerability, which was classified as critical, has been found in TA-Lib up to 0.6.4. This issue affects the function setInputBuffer of t CVE-2025-301705.5Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session CVE-2025-301719.0System File Deletion vulnerabilities in ASPECT provide attackers access to delete system files if session administrator credentials become c CVE-2025-301728.0Remote Code Execution vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPEC CVE-2025-301736.7File upload vulnerabilities are present in ASPECT if session administrator credentials become compromised This issue affects ASPECT-Enterpri CVE-2025-301747.5A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V CVE-2025-301757.5A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V CVE-2025-301767.5A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V CVE-2025-301776.5Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: fr