Adobe Experience Manager (AEM) Login Panel Detected

This plugin detects the presence of the Adobe Experience Manager AEM login panel on a web application. AEM is a comprehensive content management solution for building websites, mobile apps, and forms. No source data...

Adobe Experience Manager (AEM) QueryBuilder JCR Hashed Password Disclosure

The remote Adobe Experience Manager AEM QueryBuilder Servlet is prone to an information disclosure vulnerability. An unauthenticated attacker can exploit this issue to retrieve the hashed passwords of users in the AEM instance by sending a specially crafted HTTP request to the QueryBuilder Servle...

Adobe Experience Manager (AEM) Groovy Console

The remote Adobe Experience Manager AEM expose a Groovy console that allows users to execute arbitrary Groovy scripts on the server. This can lead to remote code execution and complete compromise of the AEM instance and the underlying server. No source data...

Adobe Experience Manager (AEM) Custom Scripts Listing Detection

The remote Adobe Experience Manager AEM instance allows for the listing of custom scripts. An unauthenticated, remote attacker can exploit this to enumerate custom scripts, which could lead to information disclosure about the application. No source data...

Adobe Experience Manager (AEM) Sling Login Panel Detected

This plugin detects the presence of the Adobe Experience Manager AEM Sling Login panel on a web application. The Sling Login panel is part of the Apache Sling framework used by AEM for content delivery and management, providing authentication and access control features. No source data...

Adobe Experience Manager (AEM) Querybuilder Internal Path Read

The remote Adobe Experience Manager AEM server is configured to allow unauthenticated users to access internal paths using the Querybuilder endpoint. This may allow an attacker to read sensitive files from the server. The Querybuilder endpoint is typically located at /bin/querybuilder.json and...

Adobe Experience Manager (AEM) CRX Package Manager Panel Detected

This plugin detects the presence of the Adobe Experience Manager AEM CRX Package Manager panel on a web application. The CRX Package Manager is a tool used to manage packages in AEM, allowing users to install, uninstall, and manage content packages. No source data...

Adobe Experience Manager (AEM) Merge Metadata Servlet Detected

This plugin detects the presence of the Adobe Experience Manager AEM Merge Metadata Servlet. The Merge Metadata Servlet is used to merge metadata from different sources within the AEM environment. No source data...

Adobe Experience Manager (AEM) Sling User Information Servlet Exposure

The remote Adobe Experience Manager AEM Sling User Information Servlet is prone to information disclosure vulnerabilities. An attacker can exploit this issue to gather information about user accounts, including usernames and other details, which could be used in subsequent attacks such as...

Adobe Experience Manager (AEM) QueryBuilder Feed Servlet Detected

This plugin detects the presence of the Adobe Experience Manager AEM QueryBuilder Feed Servlet on a web application. The QueryBuilder Feed Servlet is part of AEM's QueryBuilder API, which allows developers to construct and execute queries against the AEM repository to retrieve content based on...

Adobe Experience Manager (AEM) CRX Content Explorer

This plugin detects the presence of the Adobe Experience Manager AEM CRX Content Explorer interface. The CRX Content Explorer is a web-based interface used to manage and interact with the content repository of Adobe Experience Manager. No source data...

Adobe Experience Manager (AEM) CRX Namespace Editor Panel Detected

This plugin detects the presence of the Adobe Experience Manager AEM CRX Namespace Editor panel on a web application. The CRX Namespace Editor panel is part of the AEM's content repository management interface, allowing administrators to manage namespaces and node types within the repository...

Adobe Experience Manager (AEM) QueryBuilder JCR Role Disclosure

The remote Adobe Experience Manager AEM QueryBuilder Servlet is prone to an information disclosure vulnerability. An unauthenticated attacker can exploit this issue to retrieve the JCR roles of the AEM instance by sending a specially crafted HTTP request to the QueryBuilder Servlet endpoint. No...

Adobe Experience Manager (AEM) Debugging Client Libraries Exposure

This plugin detects the presence of the Adobe Experience Manager AEM Debugging Client Libraries on a web server. These libraries are intended for development and debugging purposes and should not be exposed in a production environment, as they may contain sensitive information or functionality th...

Adobe Experience Manager (AEM) Unauthenticated Cache Purge

This plugin detects the presence of the Adobe Experience Manager AEM Dispatcher cache purge functionality that is accessible without authentication. An unauthenticated cache purge can allow an attacker to clear cached content, leading to potential service disruption or performance degradation. No...

A Descriptive Model for Modelling Attacker Decision-Making in Cyber-Deception

Cyber-deception is an increasingly important defensive strategy, shaping adversarial decision making through controlled misinformation, uncertainty, and misdirection. Although game-theoretic, Bayesian, Markov decision process, and reinforcement learning models offer insight into deceptive...

Exploit for Incorrect Authorization in Adobe Experience_Manager_Forms

Lab: CVE-2025-54253 - Incorrect Authorization in Adobe Experie...

Exploit for Code Injection in Sitecore Experience_Commerce

CVE-...

Microsoft to Block Unauthorized Scripts in Entra ID Logins with 2026 CSP Update

Microsoft has announced plans to improve the security of Entra ID authentication by blocking unauthorized script injection attacks starting a year from now. The update to its Content Security Policy CSP aims to enhance the Entra ID sign-in experience at "login.microsoftonline.com" by only letting...

PT-2025-47930

A stored Cross-site Scripting XSS vulnerability affecting Service Items Management in DELMIA Service Process Engineer on Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...