CVE-2025-54253-Exploit-Demo

🚨 CVE-2025-54253 – Adobe AEM Forms on JEE OGNL インジェクションによるリモートコード実行 🔎 概要 CVE-2025-54253 は、Adobe AEM Forms on JEE における重大なOGNLインジェクションの脆弱性です。この脆弱性により、認証されていない攻撃者が /adminui/debug?debug=OGNL: エンドポイントを介して任意のオペレーティングシステムコマンドを実行できます。 重要度: 緊急 CVSSスコア: 9.8 未確定 攻撃ベクトル: リモート 認証の必要性: 不要 影響を受ける製品: Adobe AEM...

CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253: Adobe AEM-Formsのゼロデイの内部 — ペネトレーションテスターと防御担当者がすべきこと TL;DR: JEE上のAdobe Experience Manager AEM Forms（≤ 6.5.23.0）には、誤用されたStruts/OGNLエンドポイントを介して認証なしのリモートコード実行を可能にする深刻なネットワークアクセス可能な脆弱性（CVE-2025-54253）が存在しました。関連するXXE（CVE-2025-54254）は任意のファイル読み取りを可能にします。これらは影響の大きいエンタープライズ問題です —...

AEMPWN

AEMPWN 针对 CVE-2025-54253 与 CVE-2025-54254 的 AEM Forms 扫描器 AEMPWN 是一款针对性扫描器，用于识别高风险的 Adobe Experience Manager（AEM）Forms 漏洞，支持安全检测、盲外带（OOB）确认以及完整的概念验证（PoC）验证工作流。 此工具仅用于授权安全测试。 支持的漏洞 CVE-2025-54253 AEM Forms（JEE）中依赖配置的远程代码执行 CVE-2025-54254 XML 外部实体（XXE）注入，导致文件泄露并可能进一步升级利用 操作模式 AEMPWN...

CVE-2025-64801

Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

EUVD-2020-30521

Malware in sbrugna...

EUVD-2020-30512

Malware in sbrugna...

EUVD-2020-17164

Malware in sbrugna...

EUVD-2020-30514

Malware in sbrugna...

EUVD-2021-27887

Malicious code in bioql PyPI...

Exploit for CVE-2025-54253

!Explo...

APSB25-82 : Security update available for Adobe Experience Manager Forms

Adobe has released a security update for Adobe Experience Manager Forms on Java Enterprise Edition JEE. This update addresses critical vulnerabilities that could lead to arbitrary code execution and arbitrary file system read...

APSB25-67 : Security update available for Adobe Experience Manager Forms

Adobe has released a security update for Adobe Experience Manager Forms on JEE. This update addresses a critical vulnerability that could lead to arbitrary code execution...

APSB25-27 : Security update available for Adobe Experience Manager Forms

Adobe has released security updates for AEM Forms on JEE versions for a dependency on vulnerable Third-Party Component . This dependency update resolves an important vulnerability that could lead to path traversal and case sensitive match exception...

CVE-2021-40722

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE...

CVE-2021-40722

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE...

Xxe

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE...

CVE-2021-40722 AEM Forms Improper Restriction of XML External Entity Reference

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE...

CVE-2021-40722

Adobe Experience Manager (AEM) – CVE-2021-40722 affects AEM Forms Cloud Service and on-prem 6.5.10.0 and earlier via an XML External Entity (XXE) injection that can lead to RCE. The connected advisories list this CVE as part of APSB21-103 and note remediation by upgrading to 6.5.11.0 or applying ...

Adobe: AEM forms XXE Vulnerability

AEM Forms Cloud Service offering, as well as version 6.5.10.0 and below are affected by an XML External Entity XXE injection vulnerability that could be abused by an attacker to achieve RCE. CVE: CVE-2021-40722 Ref: https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html We...

CVE-2020-24444

AEM Forms SP6 add-on for AEM 6.5.6.0 and Forms add-on package for AEM 6.4 Service Pack 8 Cumulative Fix Pack 2 6.4.8.2 have a blind Server-Side Request Forgery SSRF vulnerability. This vulnerability could be exploited by an unauthenticated attacker to gather information about internal systems tha...