CVE-2024-26124

Adobe Experience Manager (AEM) prior to 6.5.20.0 is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields (CVSS 3.1 base score 5.4). The issue allows an attacker to inject malicious JavaScript into pages containing those fields, which could execute in a victim’s ...

CVE-2022-42345

Adobe Experience Manager (AEM) 6.5.14 and earlier are affected by a reflected XSS vulnerability (CVE-2022-42345) where a low-privilege attacker must induce a victim to visit a vulnerable URL; malicious JavaScript can execute in the victim’s browser. Impact aligns with MEDIUM severity (CVSS 3.1: A...

CVE-2024-26041

CVE-2024-26041 concerns Adobe Experience Manager (AEM) before version 6.5.20, reporting a stored XSS vulnerability in vulnerable form fields. The underlying issue is stored cross-site scripting that allows injected JavaScript to run when users visit pages containing the affected fields. Public so...

CVE-2023-22257

Adobe Experience Manager (AEM) 6.5.15.0 and earlier is affected by a URL redirect to an untrusted site (Open Redirect). The issue enables a low-privilege authenticated attacker to redirect users to a malicious site and requires user interaction. Remediation per APSB23-18 is to apply the security ...

CVE-2024-26031

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored XSS vulnerability that allows injection of malicious scripts into vulnerable form fields. Malicious JavaScript could execute in a user’s browser when they visit a page containing the vulnerable field. Remediation ...

CVE-2024-26125

CVE-2024-26125 affects Adobe Experience Manager 6.5.19 and earlier, describing a stored XSS in vulnerable form fields that could execute malicious JavaScript in a victim’s browser. Connected sources corroborate an XSS family (stored and DOM-based variants) with multiple CVEs referenced in APSB24-...

CVE-2024-26126

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by an Improper Input Validation (CWE-20) vulnerability (CVE-2024-26126) that could bypass security features and affect page integrity. The issue supports network access with low privileges and requires user interaction to exp...

CVE-2022-42357

Adobe Experience Manager (AEM) versions 6.5.14 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability triggered when a victim is enticed to visit a crafted URL, allowing malicious JavaScript to run in the victim’s browser. The vulnerability is described across multiple s...

CVE-2024-26065

Adobe Experience Manager (AEM) 6.5.19 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, enabling injected JavaScript to run in a user’s browser when visiting the page with the field. Connected sources confirm the issue affects AEM versions up ...

CVE-2024-26107

Adobe Experience Manager (AEM) 6.5.19 and earlier is affected by a reflected XSS vulnerability (CVE-2024-26107). The issue exists in vulnerable pages where crafted URLs can execute malicious JavaScript in the victim’s browser. Public references in the connected documents identify a remediation vi...

CVE-2024-26127

CVE-2024-26127 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier. The issue is an Improper Input Validation that can lead to a security feature bypass, enabling a low-privileged attacker to affect page integrity. Exploitation requires user interaction, and the base CVSS v3.1 scor...

CVE-2024-41839

CVE-2024-41839 affects Adobe Experience Manager versions 6.5.20 and earlier, with an Improper Input Validation vulnerability that can bypass security features and affect page integrity. Exploitation requires user interaction; impact is low (I:LOW) with network access and low privileges per NVD me...

CVE-2025-47045

CVE-2025-47045 affects Adobe Experience Manager 6.5.22 and earlier with a stored XSS in vulnerable form fields. Low-privilege attackers can inject malicious scripts, leading to JavaScript execution in victims’ browsers. CVSSv3.1: 5.4 (MEDIUM). Remediation is to apply an update per APSB25-48 (or n...

CVE-2022-44465

Adobe Experience Manager (AEM) up to v6.5.14 and earlier is affected by a reflected XSS vulnerability. A low-privileged attacker can entice a victim to visit a crafted URL referencing a vulnerable page, allowing malicious JavaScript to run in the victim’s browser. The issue stems from insufficien...

CVE-2023-29307

Adobe Experience Manager (AEM) 6.5.16.0 and earlier is affected by a URL Redirection to Untrusted Site vulnerability. An authenticated, low-privilege user could trigger a redirect to a malicious site, with exploitation requiring user interaction. The issue is documented under CVE-2023-29307 and i...

CVE-2024-20760

CVE-2024-20760 affects Adobe Experience Manager (AEM) versions 6.5.19 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious JavaScript that may execute in a victim’s browser when visiting a page containing t...

CVE-2024-26040

CVE-2024-26040 affects Adobe Experience Manager 6.5.19 and earlier with a stored XSS in vulnerable form fields. Exploitation requires user interaction; malicious JavaScript can run in the victim’s browser when loading a page containing the affected field. A related advisory (APSB24-05) and Nessus...

CVE-2024-26050

Adobe Experience Manager (AEM) 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields due to inadequate protection of the web page structure. The issue could allow an admin attacker to inject malicious scripts that execute in a user’s browser when visiting the aff...

CVE-2024-26051

Summary (CVE-2024-26051, Adobe Experience Manager) AEM versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that lets an attacker inject malicious scripts into vulnerable form fields. Malicious JavaScript can be executed in a victim’s browser when...

CVE-2024-26061

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields (CVE-2024-26061). An attacker could inject malicious JavaScript, which may be executed in a victim’s browser when visiting the page containing the...

CVE-2024-26101

Adobe Experience Manager (AEM) 6.5.19 and earlier is affected by a reflected Cross-Site Scripting (XSS) vulnerability. Attack requires convincing a victim to visit a URL referencing a vulnerable page, allowing malicious JavaScript to execute in the victim’s browser. CVSSv3.1 base score 5.4 (MEDIU...

CVE-2022-42350

Adobe Experience Manager (AEM) 6.5.14 and earlier is affected by a reflected Cross-Site Scripting (XSS) vulnerability. A low-privileged attacker can lure a victim to a crafted URL referencing a vulnerable page, causing malicious JavaScript to run in the victim’s browser. Affected component: AEM w...

CVE-2023-22269

CVE-2023-22269 affects Adobe Experience Manager (AEM) 6.5.x, specifically 6.5.15.0 and earlier. The vulnerability is a reflected XSS in which an attacker lures a victim to a crafted URL referencing a vulnerable page, causing malicious JavaScript to execute in the victim’s browser. Exploitation is...

CVE-2024-26067

Adobe Experience Manager (AEM) 6.5.19 and earlier is affected by a stored XSS vulnerability in vulnerable form fields. The issue arises from inadequate protection of form inputs, allowing malicious JavaScript to execute in a victim’s browser when visiting a page containing the vulnerable field. E...

CVE-2024-26096

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that allows an attacker to inject malicious scripts into vulnerable form fields, potentially executing JavaScript in a victim’s browser when visiting the page containing th...

CVE-2024-52864

CVE-2024-52864 affects Adobe Experience Manager (AEM) versions 6.5.21 and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that can cause malicious JavaScript to run in a victim’s browser when visiting a page containing the compromised field. The vulnerab...

CVE-2024-52991

CVE-2024-52991 affects Adobe Experience Manager (AEM) versions 6.5.21 and earlier, describing a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that could allow malicious JavaScript execution in a user’s browser. Public sources confirm this is tied to AEM’s 6.5.x line wi...

CVE-2022-35694

Adobe Experience Manager (AEM) 6.5.14 and earlier is affected by a reflected XSS that allows an attacker with low privileges, by enticing a victim to visit a crafted URL, to execute malicious JavaScript in the victim’s browser. The issue is described across multiple sources as a reflected Cross‑S...

CVE-2022-42346

CVE-2022-42346 affects Adobe Experience Manager 6.5.14 and earlier with a reflected XSS vulnerability. A low-privileged attacker can lure a victim to a crafted URL, causing malicious JavaScript to run in the browser. Root cause: insufficient input handling leading to reflected XSS. Impact: browse...

CVE-2022-42351

Adobe Experience Manager (AEM) versions 6.5.14 and earlier are affected by CVE-2022-42351, an Incorrect Authorization vulnerability that allows a low-privileged attacker to disclose low-level confidential information and bypass certain security features without user interaction. Affected componen...

CVE-2022-42360

Adobe Experience Manager 6.5.14 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can lure a victim to a URL referencing a vulnerable page, allowing malicious JavaScript to run in the victim’s browser. The issue is documented in CVE-...

CVE-2022-44462

CVE-2022-44462 affects Adobe Experience Manager (AEM) 6.5.14 and earlier, with a reflected XSS vulnerability that a low-privileged attacker can trigger by convincing a victim to visit a crafted URL, enabling execution of malicious JavaScript in the victim’s browser. The issue is documented across...

CVE-2022-44469

CVE-2022-44469 affects Adobe Experience Manager 6.5.14 and earlier. A reflected XSS flaw could allow a low-privileged attacker to lure a user to a crafted URL, causing malicious JavaScript to run in the victim’s browser. Impact: potential script execution within the user context; exploitation req...

CVE-2023-21616

Affected product: Adobe Experience Manager (AEM) 6.5.x, specifically 6.5.15.0 and earlier. Issue: reflected XSS in a vulnerable page, where convincing a user to visit a crafted URL could cause JavaScript to run in the victim’s browser. Root cause: improper handling of input leading to reflected c...

CVE-2023-22266

CVE-2023-22266 affects Adobe Experience Manager 6.5.15.0 and earlier. It is a URL Redirection to Untrusted Site (Open Redirect) vulnerability allowing a low-privileged authenticated user to redirect others to malicious sites; exploitation requires user interaction. Remediation: upgrade to 6.5.16....

CVE-2023-29322

Adobe Experience Manager versions 6.5.16.0 and earlier are affected by a reflected XSS vulnerability (CVE-2023-29322). A low-privileged attacker can lure a victim to a crafted URL that executes malicious JavaScript in the victim’s browser. Remediation: update to AEM 6.5.17.0 or apply vendor-suppl...

CVE-2024-26087

Adobe Experience Manager 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields (CVE-2024-26087). Root cause: stored XSS allowing injection of malicious scripts, leading to JavaScript execution in the victim’s browser when visiting a page containing the vulnerable...

CVE-2024-26104

Summary: CVE-2024-26104 is a reflected Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.19 and earlier. The issue arises when an attacker entices a user to visit a specially crafted URL referencing a vulnerable page, enabling execution of malicious JavaScrip...

CVE-2024-36239

CVE-2024-36239 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier, where a DOM-based XSS vulnerability could allow an attacker to execute arbitrary JavaScript in the victim’s browser session. Exploitation typically requires user interaction (e.g., clicking a crafted link). CVSS v3...

CVE-2022-42348

CVE-2022-42348 affects Adobe Experience Manager (AEM) 6.5.14 and earlier, through a reflected Cross-Site Scripting (XSS) flaw that can execute malicious JavaScript in a victim’s browser when a crafted URL is visited. The issue is demonstrated in AEM’s handling of vulnerable pages, with exploitati...

CVE-2022-42356

Adobe Experience Manager (AEM) 6.5.14 and earlier is affected by a reflected cross-site scripting (XSS) vulnerability. A low-privilege attacker can lure a victim to a vulnerable URL, causing malicious JavaScript to execute in the victim’s browser. The CVSS v3.1 base score is 5.4 (Medium). Remedia...

CVE-2022-42367

Adobe Experience Manager (AEM) versions 6.5.14 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2022-42367). The issue can be exploited when a low-privilege attacker entices a victim to visit a crafted URL referencing a vulnerable page, potentially executing m...

CVE-2022-44468

Affected software: Adobe Experience Manager (AEM) 6.5.14 and earlier. Vulnerability: Reflected Cross-Site Scripting (XSS) that can execute malicious JavaScript in the victim’s browser when a user visits a crafted URL referencing a vulnerable page. Root cause/impact: XSS in AEM pages; enables scri...

CVE-2023-22256

CVE-2023-22256 affects Adobe Experience Manager 6.5.15.0 and earlier with a URL Redirection to Untrusted Site (Open Redirect). Root cause: vulnerable redirect logic; exploitation requires low-privilege authenticated user interaction. Impact: possible redirection to malicious sites; CVSSv3.1 base ...

CVE-2024-26035

Adobe Experience Manager (AEM) 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields (CWE-79). The issue allows an attacker to inject malicous scripts, which may execute in a victim’s browser when visiting the affected page; exploitation requires user interaction...

CVE-2024-26037

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a DOM-based XSS vulnerability (CVE-2024-26037) that could allow arbitrary JavaScript execution in a victim’s browser, with exploitation typically requiring user interaction. Connected sources indicate fixes in the APSB24-2...

CVE-2023-22263

Adobe Experience Manager (AEM) 6.5.15.0 and earlier is affected by a URL redirection to an untrusted site (Open Redirect). The vulnerability enables a low-privilege authenticated attacker to induce users to be redirected to malicious websites, with exploitation requiring user interaction. AEM ver...

CVE-2024-26045

CVE-2024-26045 affects Adobe Experience Manager (AEM) 6.5.19 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious JavaScript that may run in a victim’s browser when the page with the vulnerable field is loa...

CVE-2024-26059

CVE-2024-26059 affects Adobe Experience Manager 6.5.19 and earlier with a stored XSS vulnerability in vulnerable form fields. An attacker could inject malicious JavaScript and have it execute in a victim’s browser when visiting the page containing the field; exploitation requires some user intera...

CVE-2024-26102

CVE-2024-26102 affects Adobe Experience Manager (AEM) 6.5.19 and earlier and is a reflected XSS vulnerability. The issue permits executing malicious JavaScript in a victim’s browser if a crafted URL references a vulnerable page. The vulnerability is documented with a Medium severity (CVSS 3.1: 5....