https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:36:28.784446+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-161891 EUVD-2026-161891 2026-10-02T22:36:28.855369+00:00 EUVD-2026-161891 https://cve.radiocsirt.org/vuln/fkie_cve-2023-5844 fkie_cve-2023-5844 2026-10-02T22:36:28.855412+00:00

Unverified Password Change in GitHub repository pimcore/admin-ui-classic-bundle prior to 1.2.0.

 https://cve.radiocsirt.org/vuln/ghsa-6f58-j323-6472 GHSA-6f58-j323-6472 — pimcore/admin-ui-classic-bundle Unverified Password Change 2026-10-02T22:36:28.855447+00:00

Affected: Packagist: pimcore/admin-ui-classic-bundle

### Impact As old password can be set as new password , it is considered as password policy violation.

Pimcore is not enforcing strict password policy which allow attacker to set old password as new password

Proof of Concept 1. Go to Admin link 2. login and click on -> "User | My Profile". 3. Go to change password now put old password as new password and click save.

### Patches https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch

### Workarounds Update to version 1.2.0 or apply this patches manually https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch

### References https://huntr.com/bounties/b031199d-192a-46e5-8c02-f7284ad74021/

 https://cve.radiocsirt.org/vuln/gsd-2023-5844 gsd-2023-5844 2026-10-02T22:36:28.855481+00:00 gsd-2023-5844