CVE-2026-123259

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields , which then execute in a victim's browser upon visiting the affected page. The vulnerability has a medium severit...

CVE-2026-123258

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interacti...

CVE-2026-119017

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to achieve arbitrary code execution in the context of the current user. This vulnerability is exploitable over the network with low complexity and requires no user inte...

CVE-2026-118482

Adobe Experience Manager is affected by an Improper Input Validation vulnerability (CWE-20) that can lead to a Security feature bypass . A low-privileged attacker can exploit this issue without user interaction to bypass security measures and gain unauthorized limited read and write access . No s...

CVE-2026-118481

Adobe Experience Manager is impacted by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker could exploit this by manipulating the DOM environment to execute malicious JavaScript within a victim's browser. This attack requires user interaction , specifically requiring a vic...

CVE-2026-118480

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interaction...

CVE-2026-118479

Adobe Experience Manager is impacted by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of a victim's browser. Successful exploitation requires user interaction, specifi...

CVE-2026-118478

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can exploit this by injecting malicious scripts into vulnerable form fields. When a victim browses to a page containing these fields, the malicious JavaScript may execute ...

CVE-2026-118197

Adobe Experience Manager is impacted by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Successful exploitation requires user interaction , sp...

CVE-2026-114372

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields, which may execute in a victim's browser upon viewing the affected page. The vulnerability is characterized by a c...

CVE-2026-114371

Adobe Experience Manager is impacted by an Incorrect Authorization vulnerability (CWE-863) that can lead to arbitrary code execution within the context of the current user. A low-privileged attacker can exploit this flaw without any user interaction. The vulnerability's impact is rated as CRITICA...

CVE-2026-113580

Adobe Experience Manager is affected by an Improper Control of Generation of Code (Code Injection) vulnerability (CWE-94). This flaw allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring any user interaction. The vulnerability is character...

CVE-2026-113579

Adobe Experience Manager is affected by an Improper Control of Generation of Code (CWE-94) vulnerability, leading to code injection . A low-privileged attacker can exploit this issue to achieve arbitrary code execution in the context of the current user without any user interaction. No specific e...

CVE-2026-123341

Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79 ). A low-privileged attacker can execute malicious JavaScript within a victim's browser by tricking them into visiting a URL referencing a vulnerable page. The vulnerability has a changed scope an...

APSB26-189 : Security update available for Adobe Experience Manager

Adobe has released a priority 2 security update for Adobe Experience Manager. This update addresses vulnerabilities rated critical and medium that could result in arbitrary code execution, privilege escalation, and security feature bypass. Adobe is not aware of any exploits in the wild for any of...

Adobe Experience Manager - XML External Entity Injection

Adobe Experience Manager 6.5, 6.4, 6.3 and 6.2 are susceptible to XML external entity injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2019-8086 info: name: Adobe...

aem-xss

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install aem-xss Run bellow command to check aem-xss -h Configurations 2. We integrated with the Telegram API to receive instant...

hopgoblin

hopgoblin hopgoblin is a scanner for Adobe Experience Manager AEM instances. It automates a handful of checks that we frequently perform manually during security assessments. Features Detects exposed QueryBuilder endpoints: /bin/querybuilder.json /bin/querybuilder.feed Abuses QueryBuilder to:...

Adobe Experience Manager 2026.0.0 < 2026.9.28386 Multiple Vulnerabilities (APSB26-152)

The version of Adobe Experience Manager installed on the remote host is prior to 2026.9.28386. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-152 advisory. - Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in...

CVE-2026-90531

Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does...