Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14059
Reference (s):
- EXPLOIT-DB:45208
- URL: https://www.exploit-db.com/exploits/45208/
- FULLDISC:20180816 SEC Consult SA-20180813-0 :: SQL Injection, XSS & CSRF vulnerabilities in Pimcore
- URL: http://seclists.org/fulldisclosure/2018/Aug/13
- http://packetstormsecurity.com/files/148954/Pimcore-5.2.3-CSRF-Cross-Site-Scripting-SQL-Injection.html