Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-30166
CVE-2025-30166:
PHP vulnerability analysis and mitigation
Overview
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. The vulnerability (CVE-2025-30166) was discovered in April 2025 and affects versions up to 1.7.5. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content (GitHub Advisory).
Technical details
The vulnerability was discovered in the /admin/email/send-test-email endpoint using the POST method. The vulnerable parameter is 'content', which permits the injection of arbitrary HTML code during the email sending process. While JavaScript code injection is blocked through filtering, HTML code injection remains possible. The vulnerability has been assigned a CVSS v4.0 score of 1.8 (LOW) with the vector string: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (GitHub Advisory).
Impact
This HTML injection vulnerability can potentially enable phishing attacks by allowing the insertion of any HTML content, such as fake login forms. The vulnerability could lead to session cookie theft and the alteration of page content. The impact is considered low due to the high attack complexity and requirement for high privileges (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been fixed in version 1.7.6 of the Pimcore Admin Classic Bundle. The fix involves implementing proper HTML tag stripping in text emails, as evidenced by the patch that adds strip_tags() function to sanitize the content parameter (GitHub Commit).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management