Pimcore allows XSS via Users Assets Data Objects Video Thumbnails Image Thumbnails Field-Collections Objectbrick Classification Store Document Types Predefined Properties Predefined Asset Metadata Quantity Value and Static Routes functions.