CVE-2022-0509

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.

• CWE-79

• https://github.com/pimcore/pimcore/commit/6ccb5c12fc1be065ebce9c89c4677ee939b88597Patch, Third Party Advisory
• https://huntr.dev/bounties/26cdf86c-8edc-4af6-8411-d569699ecd1bExploit, Patch, Third Party Advisory
• https://github.com/pimcore/pimcore/commit/6ccb5c12fc1be065ebce9c89c4677ee939b88597Patch, Third Party Advisory
• https://huntr.dev/bounties/26cdf86c-8edc-4af6-8411-d569699ecd1bExploit, Patch, Third Party Advisory

Published

Feb 8, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0503The WordPress Multisite Content Copier/Updater WordPress plu…6.1
• CVE-2022-0504Generation of Error Message Containing Sensitive Information…6.5
• CVE-2022-0505Cross-Site Request Forgery (CSRF) in Packagist microweber/mi…6.5
• CVE-2022-0506Cross-site Scripting (XSS) - Stored in Packagist microweber/…5.4
• CVE-2022-0507Found a potential security vulnerability inside the Pandora …8.8
• CVE-2022-0508Server-Side Request Forgery (SSRF) in GitHub repository choc…5.3
• CVE-2022-0510Cross-site Scripting (XSS) - Reflected in Packagist pimcore/…5.4
• CVE-2022-0511Mozilla developers and community members Gabriele Svelto, Se…8.8
• CVE-2022-0512Authorization Bypass Through User-Controlled Key in NPM url-…5.3
• CVE-2022-0513The WP Statistics WordPress plugin is vulnerable to SQL Inje…7.5
• CVE-2022-0514Business Logic Errors in GitHub repository crater-invoice/cr…6.5
• CVE-2022-0515Cross-Site Request Forgery (CSRF) in GitHub repository crate…4.3