Cross-site Scripting (XSS)

2023-03-2211:56:30

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

xss

vulnerability

pagination.js

ajax

url sanitization

modern browsers

arbitrary javascript

EPSS

0.001

Percentile

49.3%

JSON

pimcore/pimcore is vulnerable to Cross-Site Scripting (XSS). The vulnerability exists due to the ajax function in pagination.js because the url sanitization regex pattern does not take into account backward slashes (\\) that modern browsers treat as forward slashes (/) , which allows an attacker to inject and execute arbitrary JavaScript into the browser.