{"id":"CVE-2022-0257","aliases":["GHSA-v567-q267-phpg"],"url":"https://o3.security/vulnerability/CVE-2022-0257","summary":"Cross-site Scripting (XSS) - Stored in pimcore/pimcore","details":"pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","published":"2022-01-17T15:15:15Z","modified":"2026-08-12T03:51:39.488338179Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"},"epss":{"score":0.01456,"percentile":0.71063,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"pimcore/pimcore","fixedVersion":"10.2.9"}],"fix":{"url":"https://github.com/pimcore/pimcore/commit/dfaf78b26fb77990267c0cc05b9fcb9f8de7b66d","label":"pimcore/pimcore@dfaf78b"},"references":[{"type":"WEB","url":"https://huntr.dev/bounties/bad2073c-bbd5-4425-b3e9-c336b73ddda6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0257.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0257"},{"type":"FIX","url":"https://github.com/pimcore/pimcore/commit/dfaf78b26fb77990267c0cc05b9fcb9f8de7b66d"},{"type":"PACKAGE","url":"https://github.com/pimcore/pimcore"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:39.488338179Z"}}