Cross-site Scripting (XSS)

pimcore/pimcore is vulnerable to cross-site scripting. The vulnerability exists in getTreeAction function of ClassController.php because the icon field has not been escaped which allows an attacker to inject and execute arbitrary javascript...