CVE-2026-27252

CVE-2026-27252 : Adobe Experience Manager (AEM) versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privilege attacker could inject malicious JavaScript, which would be executed in a victim’s browser when they access the a...

CVE-2025-64606

CVE-2025-64606 affects Adobe Experience Manager 6.5.23 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that could let a low-privilege attacker inject malicious scripts; the attacker’s payload is executed in a victim’s browser when they visit t...

CVE-2025-64797

Adobe Experience Manager (AEM) up to version 6.5.23 is affected by a stored Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript can execute in a victim’s browser when accessing pages containin...

CVE-2025-64872

CVE-2025-64872 affects Adobe Experience Manager (AEM) 6.5.23 and earlier. The issue is a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields, which an attacker with high privileges could use to inject malicious scripts. When a victim visits a page containing the vulnerable f...

CVE-2026-27224

CVE-2026-27224 affects Adobe Experience Manager 6.5.23 and earlier, with a stored XSS vulnerability in form fields. An attacker can cause malicious JavaScript to execute in a victim’s browser when visiting a page with the vulnerable field. Remediation is available: update to a newer AEM version (...

CVE-2026-27225

CVE-2026-27225 concerns Adobe Experience Manager (AEM) versions 6.5.23 and earlier, with a stored XSS vulnerability in form fields. The underlying issue is inadequate input sanitization/output encoding, allowing a low-privileged attacker to inject malicious JavaScript that may run in a victim’s b...

CVE-2026-27236

Adobe Experience Manager (AEM) 6.5.x is affected by a stored XSS in form fields due to insufficient input sanitization/output encoding. The vulnerability enables a low-privilege attacker to inject JavaScript that executes in a victim’s browser when visiting pages containing the vulnerable field. ...

CVE-2025-64554

CVE-2025-64554 is a stored XSS in Adobe Experience Manager (AEM)

CVE-2025-64555

Summary (CVE-2025-64555) : Adobe Experience Manager (AEM) 6.5.23 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privilege attacker could inject malicious JavaScript into these fields, with scripts potentially executed in a victim’s br...

CVE-2025-64560

Adobe Experience Manager (AEM) 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2025-64560) that could allow a low-privileged attacker to execute malicious scripts in the victim’s browser. Exploitation requires user interaction (e.g., visiting a crafted...

CVE-2025-64580

CVE-2025-64580 concerns Adobe Experience Manager (AEM) 6.5.x, with 6.5.23 and earlier affected by a stored XSS vulnerability in vulnerable form fields. The underlying issue allows a low-privilege attacker to inject malicious scripts into pages containing the vulnerable field, potentially causing ...

CVE-2025-64609

CVE-2025-64609 — Adobe Experience Manager (AEM) Affects: AEM 6.5.23 and earlier. Vulnerability: Stored Cross-Site Scripting (XSS) in vulnerable form fields (CWE-79). Impact: A low-privileged attacker can inject malicious scripts; malicious JavaScript may execute in a victim’s browser when visitin...

CVE-2025-64794

CVE-2025-64794 is a stored XSS vulnerability affecting Adobe Experience Manager (AEM) versions 6.5.23 and earlier. A low-privilege attacker can inject malicious scripts into vulnerable form fields, with JavaScript potentially executed in the victim’s browser when visiting a page containing the fi...

CVE-2026-27237

Adobe Experience Manager 6.5.23 and earlier are affected by a stored XSS in form field input due to insufficient sanitization/output encoding. A low-privileged attacker can inject JavaScript that executes in a victim’s browser when visiting the vulnerable page. CVSS 3.1 base score 5.4 (NORM, LOW ...

CVE-2026-27244

Adobe Experience Manager (AEM) 6.5.x is affected by a stored Cross-Site Scripting (XSS) vulnerability in form field input. The root cause is insufficient input sanitization, allowing low-privileged attackers to inject JavaScript that executes in a victim’s browser when visiting pages containing t...

CVE-2026-27262

Adobe Experience Manager (AEM) up to version 6.5.23 is affected by a stored XSS vulnerability in how form field input is sanitized and output is encoded. The root cause is reported as insufficient input cleanup and output encoding, allowing attacker-supplied JavaScript to execute in a victim’s br...

CVE-2025-64553

Adobe Experience Manager (AEM) 6.5.23 and earlier are affected by a stored cross-site scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may execute in a victim’s browser when they visit a page containi...

CVE-2025-64604

CVE-2025-64604 : Adobe Experience Manager (AEM) 6.5.23 and earlier is affected by a stored XSS vulnerability in form fields. The issue allows a low-privileged attacker to inject malicious scripts into vulnerable fields, which can execute in the victim’s browser when visiting a page with the vulne...

CVE-2025-64814

Adobe Experience Manager (AEM) 6.5.23 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability. The issue allows a low-privileged attacker to inject malicious scripts into vulnerable form fields, with malicious JavaScript potentially executed in a victim’s browser when visitin...

CVE-2025-64823

Adobe Experience Manager (AEM) up to version 6.5.23 is affected by a stored Cross-Site Scripting (XSS) vulnerability that enables a low-privileged attacker to inject malicious scripts into vulnerable form fields, with malicious JavaScript executed in the victim’s browser when visiting the affecte...

CVE-2025-64544

Adobe Experience Manager (AEM) 6.5.23 and earlier is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2025-64544) that could allow a low-privileged attacker to cause malicious scripts to run in the victim’s browser. Exploitation requires user interaction (e.g., visiting a cra...

CVE-2025-64547

CVE-2025-64547 involves Adobe Experience Manager (AEM) 6.5.23 and earlier, with a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The underlying issue allows a low-privilege attacker to inject malicious scripts, which may execute in a victim’s browser when visiting a pa...

CVE-2025-64586

Adobe Experience Manager (AEM) versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious JavaScript, which may execute in a victim’s browser when visiting a page containing the vulnerable...

CVE-2025-64590

CVE-2025-64590 describes a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.23 and earlier. A low privileged attacker can inject malicious scripts into vulnerable form fields, with malicious JavaScript executed in the victim’s browser when visiting the affected page. This i...

CVE-2025-64808

Adobe Experience Manager (AEM) 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability (CVE-2025-64808). A low-privileged attacker can inject malicious scripts into vulnerable form fields, with malicious JavaScript executed in a victim’s browser when visiting the page...

CVE-2026-27250

Adobe Experience Manager (AEM) 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in form fields. The issue allows a low-privilege attacker to inject malicious scripts, which may execute in a victim’s browser when the page containing the vulnerable field is loade...

CVE-2025-64605

CVE-2025-64605 affects Adobe Experience Manager (AEM) 6.5.23 and earlier. The issue is a stored XSS in vulnerable form fields, enabling a low-privileged attacker to inject malicious scripts that run in a victim’s browser when visiting the affected page. The defined impact includes execution of cr...

CVE-2025-64626

Adobe Experience Manager (AEM) 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious scripts, which may execute in a victim’s browser when visiting the page containing the field. The issue is ...

CVE-2025-64579

Adobe Experience Manager (AEM) 6.5.23 and earlier is affected by a stored XSS vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious JavaScript which is executed in a victim’s browser when visiting a page containing the vulnerable field. The issue is documented ac...

CVE-2025-64607

CVE-2025-64607 affects Adobe Experience Manager (AEM) 6.5.23 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing a low-privilege attacker to inject malicious scripts. Malicious JavaScript can execute in a victim’s browser when they view ...

CVE-2025-64577

CVE-2025-64577 affects Adobe Experience Manager (AEM) 6.5.23 and earlier, with a stored cross-site scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious scripts, which may execute in a victim’s browser when visiting the page containing the vulnera...

CVE-2026-27227

Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in form fields. The root cause is insufficient input sanitization and output encoding , allowing a low-privileged attacker to inject malicious JavaScript that executes in a victi...

CVE-2026-79905

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields; when a victim browses the affected page, the injected JavaScript executes in the victim's browser. The vulnerabil...

CVE-2025-64618

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they browse the affected page. The attack requires user interaction and ...

CVE-2026-71356

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript in the victim's browser context, requiring the victim to visit a crafted webpage. The CVSS v3.1 b...

CVE-2025-64854

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields , and malicious JavaScript may execute in a victim's browser when they view the page containing the field. The CVS...

CVE-2026-19479

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction —the victim must visit a crafted webpag...

CVE-2026-71565

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction —the victim must visi...

CVE-2025-64589

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields , which execute in a victim's browser when they visit the affected page. The vulnerability scores CVSS 5.4 (MEDIUM...

CVE-2025-64838

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they view the page containing the injected content. The CVSS v3.1 score ...

CVE-2026-19612

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction , as the victim must visi...

CVE-2026-71357

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can manipulate the DOM environment to execute malicious JavaScript in the victim's browser. Exploitation requires user interaction —the victim must visit a crafted webpage. The CVSS ...

CVE-2026-75637

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability classified as CWE-79 . An attacker can exploit this by manipulating the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction , specif...

CVE-2026-75642

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser upon viewing the page. The CVSS 3.1 score is 5.4 (MEDIUM) with a vector o...

CVE-2026-75643

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses the affected page, the injected JavaScript executes in their browser, with change...

CVE-2026-75706

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79 ). An attacker can manipulate the DOM environment to execute malicious JavaScript within the victim's browser context. Exploitation requires user interaction (the victim must visit a crafted webpa...

CVE-2026-75726

Adobe Experience Manager is affected by an Improper Input Validation (CWE-20) vulnerability that can lead to a security feature bypass , allowing a low-privileged attacker to gain unauthorized limited write access . Exploitation requires user interaction —the victim must visit a maliciously craft...

CVE-2025-64542

CVE-2025-64542 affects Adobe Experience Manager versions 6.5.23 and earlier with a DOM-based Cross-Site Scripting (XSS) flaw (CWE-79). A low-privileged attacker can manipulate the DOM environment to execute malicious JavaScript in a victim's browser, potentially leading to arbitrary code executio...

CVE-2025-64588

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields; when a victim browses the affected page, the injected JavaScript executes in their browser. The CVSS 3.1 score is...

CVE-2025-64610

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability. A low-privileged attacker can inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they view the affected page. The changed scope (CVSS 3.1: 5.4 MEDIUM , vector AV:...