CVE-2022-42362

CVE-2022-42362 concerns Adobe Experience Manager (AEM) 6.5.14 and earlier, with a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who lure a user to a crafted URL can cause malicious JavaScript to run in the victim’s browser context. The available connected documents confirm the a...

CVE-2023-22261

Adobe Experience Manager (AEM) 6.5.15.0 and earlier is affected by a URL redirection to an untrusted site vulnerability (Open Redirect). A low-privilege authenticated user can trigger redirects to malicious sites, with exploitation requiring user interaction. Remediation: update to 6.5.16.0 or la...

CVE-2024-26056

Adobe Experience Manager (AEM)

CVE-2024-26063

CVE-2024-26063 affects Adobe Experience Manager up to 6.5.19 and earlier. It is an Information Exposure vulnerability leading to a security feature bypass, exploitable without user interaction. CVSS v3.1 base score 5.3 (Medium). Remediation per connected documents: apply the APSB24-05 update; upg...

CVE-2021-40722

Adobe Experience Manager (AEM) – CVE-2021-40722 affects AEM Forms Cloud Service and on-prem 6.5.10.0 and earlier via an XML External Entity (XXE) injection that can lead to RCE. The connected advisories list this CVE as part of APSB21-103 and note remediation by upgrading to 6.5.11.0 or applying ...

CVE-2022-30679

Adobe Experience Manager (AEM) 6.5.14 and earlier is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2022-30679). A low-privileged attacker can entice a victim to visit a crafted URL, enabling malicious JavaScript to run in the victim’s browser. CVSS metrics indicate Network...

CVE-2022-35693

CVE-2022-35693 concerns Adobe Experience Manager (AEM) up to version 6.5.14 and earlier, with a reflected XSS vulnerability. The issue arises from how vulnerable pages reference user-controlled data, allowing a low-privileged attacker to lure a victim to a crafted URL and cause arbitrary JavaScri...

CVE-2022-42366

Adobe Experience Manager (AEM)

CVE-2022-44473

CVE-2022-44473 affects Adobe Experience Manager (AEM) versions 6.5.14 and earlier. A reflected XSS vulnerability allows a low-privileged attacker to lure a victim to a crafted URL, causing arbitrary JavaScript to execute in the victim’s browser. Root cause is described as insufficient protection ...

CVE-2024-26041

CVE-2024-26041 concerns Adobe Experience Manager (AEM) before version 6.5.20, reporting a stored XSS vulnerability in vulnerable form fields. The underlying issue is stored cross-site scripting that allows injected JavaScript to run when users visit pages containing the affected fields. Public so...

CVE-2024-26054

CVE-2024-26054 affects Adobe Experience Manager (AEM) 6.5.20 and earlier, with a stored Cross-Site Scripting (XSS) vulnerability that lets an attacker inject malicious scripts into vulnerable form fields, causing malicious JavaScript to run in a victim’s browser when visiting a page containing th...

CVE-2024-26118

CVE-2024-26118 affects Adobe Experience Manager 6.5.19 and earlier. The vulnerability is a reflected XSS in vulnerable pages that allows an attacker to cause a victim to execute malicious JavaScript in their browser when visiting a crafted URL. The issue requires user interaction to exploit. AEM ...

CVE-2019-8087

CVE-2019-8087 affects Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2. The issue is an XML External Entity (XXE) injection that could lead to sensitive information disclosure. Root cause is XXE in AEM’s handling of XML external entities. Public details confirm the vulnerability exists and...

CVE-2024-20799

CVE-2024-20799 affects Adobe Experience Manager (AEM) 6.5.19 and earlier, with a stored XSS vulnerability in vulnerable form fields that can cause arbitrary JavaScript execution in a victim’s browser when the page containing the field is visited. The issue is confirmed in multiple sources, includ...

CVE-2024-26064

Adobe Experience Manager is affected in versions 6.5.19 and earlier by a DOM‑based XSS vulnerability (CVE-2024-26064). The issue allows an attacker to inject malicious scripts that execute in the victim’s browser when they visit a page containing the vulnerable script, potentially leading to arbi...

CVE-2024-26069

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields that can inject malicious JavaScript executed in a victim’s browser. Contributing details from connected sources confirm the issue is a stored XSS (CWE-79) and that expl...

CVE-2024-41839

CVE-2024-41839 affects Adobe Experience Manager versions 6.5.20 and earlier, with an Improper Input Validation vulnerability that can bypass security features and affect page integrity. Exploitation requires user interaction; impact is low (I:LOW) with network access and low privileges per NVD me...

CVE-2022-38438

CVE-2022-38438 affects Adobe Experience Manager versions 6.5.13.0 and earlier with a reflected Cross-Site Scripting (XSS) vulnerability. The issue can be triggered when a victim is convinced to visit a vulnerable URL, allowing malicious JavaScript to execute in the browser context. Exploitation r...

CVE-2022-42357

Adobe Experience Manager (AEM) versions 6.5.14 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability triggered when a victim is enticed to visit a crafted URL, allowing malicious JavaScript to run in the victim’s browser. The vulnerability is described across multiple s...

CVE-2024-26031

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored XSS vulnerability that allows injection of malicious scripts into vulnerable form fields. Malicious JavaScript could execute in a user’s browser when they visit a page containing the vulnerable field. Remediation ...

CVE-2024-26065

Adobe Experience Manager (AEM) 6.5.19 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, enabling injected JavaScript to run in a user’s browser when visiting the page with the field. Connected sources confirm the issue affects AEM versions up ...

CVE-2024-26125

CVE-2024-26125 affects Adobe Experience Manager 6.5.19 and earlier, describing a stored XSS in vulnerable form fields that could execute malicious JavaScript in a victim’s browser. Connected sources corroborate an XSS family (stored and DOM-based variants) with multiple CVEs referenced in APSB24-...

CVE-2024-26127

CVE-2024-26127 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier. The issue is an Improper Input Validation that can lead to a security feature bypass, enabling a low-privileged attacker to affect page integrity. Exploitation requires user interaction, and the base CVSS v3.1 scor...

CVE-2019-8085

Adobe Experience Manager (AEM) 6.x — specifically versions 6.5, 6.4, 6.3 and 6.2 — is affected by a reflected cross-site scripting vulnerability (CVE-2019-8085). Exploitation could lead to sensitive information disclosure. The advisory APSB19-48 and the Nessus plugin indicate patches: 6.3.3.6, 6....

CVE-2023-22257

Adobe Experience Manager (AEM) 6.5.15.0 and earlier is affected by a URL redirect to an untrusted site (Open Redirect). The issue enables a low-privilege authenticated attacker to redirect users to a malicious site and requires user interaction. Remediation per APSB23-18 is to apply the security ...

CVE-2024-26051

Summary (CVE-2024-26051, Adobe Experience Manager) AEM versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that lets an attacker inject malicious scripts into vulnerable form fields. Malicious JavaScript can be executed in a victim’s browser when...

CVE-2024-26105

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability, enabling malicious JavaScript to run in a victim’s browser when a user visits a crafted URL. The issue is described with a CVSS v3.1 base score of 5.4 (Medium) with net...

CVE-2024-36226

CVE-2024-36226 affects Adobe Experience Manager 6.5.20 and earlier. The issue is an Improper Input Validation that could bypass security features and affect page integrity; exploitation requires user interaction. AEM versions prior to 6.5.21 are also noted across multiple sources as vulnerable to...

CVE-2022-30677

Adobe Experience Manager (AEM) 6.5.13.0 and earlier is affected by a reflected Cross-Site Scripting (XSS) vulnerability. The issue allows an attacker who can persuade a user to visit a crafted URL referencing a vulnerable page to have malicious JavaScript executed in the user’s browser; exploitat...

CVE-2022-42345

Adobe Experience Manager (AEM) 6.5.14 and earlier are affected by a reflected XSS vulnerability (CVE-2022-42345) where a low-privilege attacker must induce a victim to visit a vulnerable URL; malicious JavaScript can execute in the victim’s browser. Impact aligns with MEDIUM severity (CVSS 3.1: A...

CVE-2022-44462

CVE-2022-44462 affects Adobe Experience Manager (AEM) 6.5.14 and earlier, with a reflected XSS vulnerability that a low-privileged attacker can trigger by convincing a victim to visit a crafted URL, enabling execution of malicious JavaScript in the victim’s browser. The issue is documented across...

CVE-2023-29307

Adobe Experience Manager (AEM) 6.5.16.0 and earlier is affected by a URL Redirection to Untrusted Site vulnerability. An authenticated, low-privilege user could trigger a redirect to a malicious site, with exploitation requiring user interaction. The issue is documented under CVE-2023-29307 and i...

CVE-2024-26040

CVE-2024-26040 affects Adobe Experience Manager 6.5.19 and earlier with a stored XSS in vulnerable form fields. Exploitation requires user interaction; malicious JavaScript can run in the victim’s browser when loading a page containing the affected field. A related advisory (APSB24-05) and Nessus...

CVE-2024-26101

Adobe Experience Manager (AEM) 6.5.19 and earlier is affected by a reflected Cross-Site Scripting (XSS) vulnerability. Attack requires convincing a victim to visit a URL referencing a vulnerable page, allowing malicious JavaScript to execute in the victim’s browser. CVSSv3.1 base score 5.4 (MEDIU...

CVE-2024-26107

Adobe Experience Manager (AEM) 6.5.19 and earlier is affected by a reflected XSS vulnerability (CVE-2024-26107). The issue exists in vulnerable pages where crafted URLs can execute malicious JavaScript in the victim’s browser. Public references in the connected documents identify a remediation vi...

CVE-2024-26124

Adobe Experience Manager (AEM) prior to 6.5.20.0 is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields (CVSS 3.1 base score 5.4). The issue allows an attacker to inject malicious JavaScript into pages containing those fields, which could execute in a victim’s ...

CVE-2025-49533

Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution. The issue enables pre-auth, no-user-interaction exploitation and is associated with AEM Forms/Deserialization vectors in multi...

CVE-2022-30680

Adobe Experience Manager (AEM) 6.5.13.0 and earlier is affected by a reflected XSS vulnerability (CVE-2022-30680). The issue allows executing malicious JavaScript in a victim’s browser when a user visits a crafted URL referencing a vulnerable page; exploitation requires low-privilege access. The ...

CVE-2022-35694

Adobe Experience Manager (AEM) 6.5.14 and earlier is affected by a reflected XSS that allows an attacker with low privileges, by enticing a victim to visit a crafted URL, to execute malicious JavaScript in the victim’s browser. The issue is described across multiple sources as a reflected Cross‑S...

CVE-2022-42346

CVE-2022-42346 affects Adobe Experience Manager 6.5.14 and earlier with a reflected XSS vulnerability. A low-privileged attacker can lure a victim to a crafted URL, causing malicious JavaScript to run in the browser. Root cause: insufficient input handling leading to reflected XSS. Impact: browse...

CVE-2022-42367

Adobe Experience Manager (AEM) versions 6.5.14 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2022-42367). The issue can be exploited when a low-privilege attacker entices a victim to visit a crafted URL referencing a vulnerable page, potentially executing m...

CVE-2023-21616

Affected product: Adobe Experience Manager (AEM) 6.5.x, specifically 6.5.15.0 and earlier. Issue: reflected XSS in a vulnerable page, where convincing a user to visit a crafted URL could cause JavaScript to run in the victim’s browser. Root cause: improper handling of input leading to reflected c...

CVE-2023-29322

Adobe Experience Manager versions 6.5.16.0 and earlier are affected by a reflected XSS vulnerability (CVE-2023-29322). A low-privileged attacker can lure a victim to a crafted URL that executes malicious JavaScript in the victim’s browser. Remediation: update to AEM 6.5.17.0 or apply vendor-suppl...

CVE-2024-26087

Adobe Experience Manager 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields (CVE-2024-26087). Root cause: stored XSS allowing injection of malicious scripts, leading to JavaScript execution in the victim’s browser when visiting a page containing the vulnerable...

CVE-2024-52864

CVE-2024-52864 affects Adobe Experience Manager (AEM) versions 6.5.21 and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that can cause malicious JavaScript to run in a victim’s browser when visiting a page containing the compromised field. The vulnerab...

CVE-2022-34218

CVE-2022-34218 affects Adobe Experience Manager 6.5.13.0 and earlier with a reflected XSS vulnerability. An attacker can lure a victim to a crafted URL, causing malicious JavaScript to run in the victim’s browser (low privileges required). The CVSSv3.1 base score is 5.4 (MEDIUM). Remediation per ...

CVE-2022-42350

Adobe Experience Manager (AEM) 6.5.14 and earlier is affected by a reflected Cross-Site Scripting (XSS) vulnerability. A low-privileged attacker can lure a victim to a crafted URL referencing a vulnerable page, causing malicious JavaScript to run in the victim’s browser. Affected component: AEM w...

CVE-2024-20760

CVE-2024-20760 affects Adobe Experience Manager (AEM) versions 6.5.19 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious JavaScript that may execute in a victim’s browser when visiting a page containing t...

CVE-2024-26035

Adobe Experience Manager (AEM) 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields (CWE-79). The issue allows an attacker to inject malicous scripts, which may execute in a victim’s browser when visiting the affected page; exploitation requires user interaction...

CVE-2024-26096

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject malicious scripts into vulnerable form fields, potentially executing JavaScript in a victim’s browser when visiting the page containing th...