pimcore/pimcore is vulnerable to Cross-Site Scripting (XSS). The vulnerability exists due to the ajax
function in pagination.js
because the url sanitization regex pattern does not take into account backward slashes (\\
) that modern browsers treat as forward slashes (/
) , which allows an attacker to inject and execute arbitrary JavaScript into the browser.