Description

pimcore is vulnerable to XSS atNamefield inDocument Typesmodule inSettings.

Payload

"&gt;<img src>

Proof of Concept

1.Go to https://11.x-dev.pimcore.fun/admin/ and login.
2.In the left menu bar, go to Settings ->Document Typesand click onAdd button to add a new record.
3.Edit the New Document Types by the payload "&gt;<img src> into theName field.
4.Click on delete icon (X) on that new added record, you will see the XSS popup triggers.