CVE-2019-10867

PoC ×3—

CVSS 3.0

8.8 high

EPSS

69%p99

Published

Apr 4, 2019 (Apr 4, 2019)

Modified

Jun 17, 2026

Description

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.

Vendors: pimcore
Products: pimcore
Weakness: CWE-502
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (68.9%)

In the news0 stories

No ingested article mentions this CVE yet.