CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253: Inside the Adobe AEM-Forms Zero-Day — What Pentesters & Defenders Must Do TL;DR: Adobe Experience Manager AEM Forms on JEE ≤ 6.5.23.0 contained a critical, network-accessible flaw CVE-2025-54253 that allows unauthenticated remote code execution via misused Struts/OGNL endpoints. A...

CVE-2025-54253-Exploit-Demo

🚨 CVE-2025-54253 – Adobe AEM Forms on JEE OGNL Injection to RCE 🔎 Overview CVE-2025-54253 is a critical OGNL injection vulnerability in Adobe AEM Forms on JEE. It allows unauthenticated attackers to execute arbitrary operating system commands via the /adminui/debug?debug=OGNL: endpoint. Severity:...

CVE-2026-75651 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

@adobe/aem-cli (>=16.21.1, <=16.21.6), @adobe/helix-docx2md (>=1.9.29, <=1.9.31) +104 more potentially affected by CVE-2026-73643 via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =0.0.1-alpha.0, =1.0.8, =0.1.2, =0.11.0, =5.7.5, =7.0.4 - @davidsneighbour/markdownlint-config 2026.0.5 - @depup/nestjsswagger 11.4.6-depup.1 and more Source cves: CVE-2026-73643 Source advisory:...

Adobe AEM Debugging Client Libraries Detection

Detects Adobe AEM Debugging Client Libraries. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe AEM Debugging Client Libraries.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Debugging Client...

Adobe AEM Explorer NodeTypes Exposure Detection

Adobe AEM Explorer NodeTypes is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM Explorer NodeTypes is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Explorer NodeTypes Exposure...

Adobe AEM Installed OSGI Bundles Detection

Adobe AEM Installed OSGI Bundles leaked. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM Installed OSGI Bundles leaked.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Installed OSGI Bundles...

Adobe AEM Security Users Exposure Detection

Adobe AEM Security Users are exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM Security Users are exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Security Users Exposure Detection',...

Adobe AEM CRX Browser Exposure Detection

Detects Adobe AEM CRX Browser Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe AEM CRX Browser Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Browser Exposure Detection',...

Adobe AEM CRX Namespace Editor Exposure Detection

Adobe AEM CRX Namespace Editor is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM CRX Namespace Editor is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Namespace Editor Exposu...

Adobe AEM CRX Search Exposed Detection

Detects Adobe AEM CRX Search Exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe AEM CRX Search Exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Search Exposed Detection',...

Adobe AEM Sling User Info Servlet Exposure Detection

Detects Adobe AEM Sling User Info Servlet Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe AEM Sling User Info Servlet Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Sling Use...

Adobe AEM ACS Common Exposure Detection

Adobe AEM ACS Common pages exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM ACS Common pages exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM ACS Common Exposure Detection',...

Adobe AEM CRX Package Manager - Panel Detect

Adobe AEM CRX Package Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM CRX Package Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Package...

Adobe AEM Disk Usage Information Disclosure Detection

Adobe AEM Disk Usage Information is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM Disk Usage Information is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Disk Usage Information...

Adobe AEM JCR Compare Exposure Detection

Detected an exposed Adobe AEM JCR compare functionality that was accessible without proper authorization. This exposure may have allowed attackers to infer repository structure or sensitive content through comparison operations. !/usr/bin/env python3 -- coding: utf-8 -- """Detected an exposed Ado...

Adobe AEM Dispatcher <4.15 - Rules Bypass Detection

Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, which allows remote attackers to bypass dispatcher rules via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 -- """Dispatcher before 4.""" from kittysploit import from...

Adobe AEM Offloading Browser Detection

Adobe AEM Offloading Browser is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM Offloading Browser is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Offloading Browser Detection',...

Adobe AEM External Link Checker Exposure Detection

Detects Adobe AEM External Link Checker Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe AEM External Link Checker Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM External Link...

@adobe/aem-cli (>=16.21.1, <=16.21.6), @adobe/helix-docx2md (>=1.9.29, <=1.9.31) +104 more potentially affected by CVE-2026-73643 via js-yaml (>=5.0.0, <=5.2.1)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =0.0.1-alpha.0, =1.0.8, =0.1.2, =0.11.0, =5.7.5, =7.0.4 - @davidsneighbour/markdownlint-config 2026.0.5 - @depup/nestjsswagger 11.4.6-depup.1 and more Source cves: CVE-2026-73643 Source advisory:...