{"id":"CVE-2022-0256","aliases":["GHSA-57hg-26h7-9qgv"],"url":"https://o3.security/vulnerability/CVE-2022-0256","summary":"Cross-site Scripting (XSS) - Stored in pimcore/pimcore","details":"pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","published":"2022-01-17T15:10:09Z","modified":"2026-08-12T03:51:48.843919712Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},"epss":{"score":0.00642,"percentile":0.47856,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"pimcore/pimcore","fixedVersion":"10.2.9"}],"fix":{"url":"https://github.com/pimcore/pimcore/commit/dff1cb0c466abcd55f1268934de3ed937b7436a7","label":"pimcore/pimcore@dff1cb0"},"references":[{"type":"WEB","url":"https://huntr.dev/bounties/8d88e48a-7124-4aaf-9f1d-6cfe4f9a79c1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0256.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0256"},{"type":"FIX","url":"https://github.com/pimcore/pimcore/commit/dff1cb0c466abcd55f1268934de3ed937b7436a7"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:48.843919712Z"}}