CVE-2024-26045

CVE-2024-26045 affects Adobe Experience Manager (AEM) 6.5.19 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious JavaScript that may run in a victim’s browser when the page with the vulnerable field is loa...

CVE-2024-26079

CVE-2024-26079 affects Adobe Experience Manager 6.5.19 and earlier, with a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. Malicious JavaScript could execute in a user’s browser when visiting a page containing the affected field. The weakness is documented across multip...

CVE-2024-36231

CVE-2024-36231 affects Adobe Experience Manager versions 6.5.20 and earlier, with a DOM-based XSS vulnerability that could allow arbitrary JavaScript execution in the victim’s browser session. Exploitation typically requires user interaction (e.g., clicking a crafted link or submitting a form). T...

CVE-2024-53968

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based XSS vulnerability that could allow an attacker to execute arbitrary code in the victim’s browser. The issue arises from how the DOM environment is manipulated in the victim’s browser, enabling a low‑privileged attacker t...

CVE-2024-53969

Adobe Experience Manager (AEM) 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue arises from DOM manipulation in the victim’s browser, allowing a low-privilege attacker to inject scripts that execute in the user’s browser session. Exploitation requ...

CVE-2024-26102

CVE-2024-26102 affects Adobe Experience Manager (AEM) 6.5.19 and earlier and is a reflected XSS vulnerability. The issue permits executing malicious JavaScript in a victim’s browser if a crafted URL references a vulnerable page. The vulnerability is documented with a Medium severity (CVSS 3.1: 5....

CVE-2024-26120

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields. Root cause: inadequate input handling allows attacker-supplied script to be stored and later executed in a victim’s browser when visiting the page. Impact: cross-site s...

CVE-2024-26122

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability tracked as CVE-2024-26122. The issue occurs in vulnerable form fields where attacker-supplied input is stored and later rendered in a victim’s browser, enabling injection o...

CVE-2024-53960

Adobe Experience Manager (AEM) versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious JavaScript that executes in a victim’s browser when visiting the affected page. The issue is documented ...

CVE-2024-53967

CVE-2024-53967 affects Adobe Experience Manager 6.5.21 and earlier, due to a DOM-based XSS flaw that allows an attacker with low privileges to cause arbitrary code execution in the victim’s browser after user interaction. The issue stems from insufficient input handling in the DOM environment. Af...

CVE-2025-46917

Adobe Experience Manager (AEM) prior to 6.5.23 is affected by a stored XSS in vulnerable form fields (CVE-2025-46917). A low-privilege attacker can inject malicious scripts, with exploitation requiring user interaction and potentially changing confidentiality/integrity impacts. Remediation per AP...

CVE-2022-42364

CVE-2022-42364 (Adobe Experience Manager) is a reflected Cross-Site Scripting vulnerability affecting AEM 6.5.14 and earlier. The issue arises in how vulnerable pages process input, allowing a low-privilege attacker to lure a user to a crafted URL and execute malicious JavaScript in the victim’s ...

CVE-2022-44470

CVE-2022-44470 affects Adobe Experience Manager (AEM) 6.5.14 and earlier. It is a reflected Cross-Site Scripting (XSS) vulnerability: if a low-privileged user is induced to visit a URL referencing a vulnerable page, a victim’s browser may execute malicious JavaScript. The issue is explicitly desc...

CVE-2022-44471

Adobe Experience Manager 6.5.14 and earlier are affected by CVE-2022-44471: a reflected XSS that allows a low-privileged attacker to lure a victim to a vulnerable URL and have malicious JavaScript run in the victim’s browser. The records note available security updates for AEM (APSB22-59) to addr...

CVE-2023-29302

CVE-2023-29302 affects Adobe Experience Manager versions ≤ 6.5.16.0. The vulnerability is a reflected Cross-Site Scripting (XSS) flaw: if a low-privileged user is persuaded to visit a crafted URL referencing a vulnerable AEM page, malicious JavaScript can execute in the victim’s browser. The issu...

CVE-2024-26046

CVE-2024-26046 affects Adobe Experience Manager up to version 6.5.19 (and earlier). It is a stored Cross‑Site Scripting (XSS) vulnerability where malicious JavaScript can be injected into vulnerable form fields and executed in a victim’s browser when visiting the affected page. Remediation: upgra...

CVE-2024-26091

CVE-2024-26091 is a DOM-based XSS affecting Adobe Experience Manager 6.5.20 and earlier. The issue could allow an attacker to run arbitrary JavaScript in the victim’s browser, typically requiring user interaction. The connected advisories indicate Adobe released updates (APSB24-28) to address vul...

CVE-2024-36227

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a DOM-based XSS (CWE-79) that could allow an attacker to execute arbitrary JavaScript in the victim’s browser session. Exploitation typically requires user interaction (e.g., clicking a crafted link or submitting a malicious form)....

CVE-2024-36230

CVE-2024-36230 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier. The issue is a DOM-based Cross-Site Scripting (XSS) vulnerability that could let an attacker run arbitrary JavaScript in a victim’s browser context. Exploitation normally requires user interaction (e.g., clicking a...

CVE-2025-46899

Adobe Experience Manager 6.5.22 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. A low‑privileged attacker, with user interaction, can inject malicious JavaScript executed in a victim’s browser when visiting the vulnerable page. remediation:...

CVE-2022-42365

CVE-2022-42365 – AEM reflected XSS : Adobe Experience Manager 6.5.14 and earlier is vulnerable to a reflected Cross-Site Scripting attack. A low-privilege attacker can trick a user into visiting a URL referencing a vulnerable page, causing malicious JavaScript to execute in the user’s browser con...

CVE-2022-44488

Adobe Experience Manager (AEM) versions 6.5.14 and earlier are affected by CVE-2022-44488, an Open Redirect vulnerability where a low-privilege authenticated attacker can cause users to be redirected to a malicious site. Exploitation requires user interaction. Mitigation: upgrade to a fixed versi...

CVE-2024-26029

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability (CVE-2024-26029) that could bypass security features and disclose information. The issue is network-accessible with no user interaction required, as described in NVD and CVE records...

CVE-2024-26030

Adobe Experience Manager 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields. The issue allows attacker-injected JavaScript to run in a victim’s browser when visiting affected pages. Remediation is available via Adobe APSB24-05 security update; apply the APSB24...

CVE-2024-26073

CVE-2024-26073 affects Adobe Experience Manager (AEM) 6.5.19 and earlier, with a stored XSS vulnerability in vulnerable form fields that can inject malicious JavaScript executed in a victim’s browser when visiting the page containing the field. The exploitation requires user interaction and is ti...

CVE-2024-36234

Adobe Experience Manager (AEM)

CVE-2025-46997

Adobe Experience Manager (AEM) 6.5.22 and earlier is affected by a stored XSS vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious scripts, which may execute in a victim’s browser when visiting the affected page. The issue’s impact is consistent with stored XSS ...

CVE-2022-35695

CVE-2022-35695 affects Adobe Experience Manager (AEM) versions 6.5.14 and earlier, with a reflected XSS vulnerability that can cause malicious JavaScript to execute in a victim’s browser when a user is lured to a crafted URL. Exploitation requires user interaction and low privileges. Affected com...

CVE-2022-42349

Summary: CVE-2022-42349 affects Adobe Experience Manager (AEM) 6.5.14 and earlier. The issue is a reflected Cross‑Site Scripting (XSS) vulnerability that can execute malicious JavaScript in a victim’s browser if the user visits a crafted URL referencing a vulnerable page. Impact details : attacke...

CVE-2023-22259

The CVE-2023-22259 issue affects Adobe Experience Manager versions 6.5.15.0 and earlier, where an Open Redirect vulnerability allows a low-privilege authenticated user to redirect victims to malicious sites. The exploit requires user interaction, and the vulnerable component is the URL redirectio...

CVE-2024-26033

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The root cause is a stored XSS condition that could allow an attacker to inject malicious JavaScript, which may execute in a user’s browser when ...

CVE-2024-43737

CVE-2024-43737 affects Adobe Experience Manager (AEM) 6.5.21 and earlier. The vulnerability is a stored Cross-Site Scripting (XSS) flaw in vulnerable form fields, enabling an attacker to inject malicious JavaScript that runs in a victim’s browser when loading the affected page. Public-facing sour...

CVE-2024-53966

CVE-2024-53966 concerns Adobe Experience Manager (AEM) versions 6.5.21 and earlier, affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker could inject malicious scripts, which execute in a victim’s browser when they access the affected ...

CVE-2024-20768

CVE-2024-20768 is a stored XSS in Adobe Experience Manager (AEM) 6.5.19 and earlier. The vulnerability allows injected JavaScript in vulnerable form fields, which executes in a victim’s browser when loading the page containing the field. Affected product/versions: AEM 6.5.19 and earlier. Root cau...

CVE-2024-26039

CVE-2024-26039 : Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue could allow an attacker to execute arbitrary JavaScript in the victim’s browser session, with exploitation typically requiring user interacti...

CVE-2024-26058

CVE-2024-26058 affects Adobe Experience Manager 6.5.20 and earlier with a DOM-based XSS that can execute JavaScript in the victim’s browser after user interaction. The CVSSv3.1 base score is 5.4 (Medium). Multiple connected documents confirm this family of issues and that Adobe released fixes via...

CVE-2024-26074

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored XSS vulnerability (CVE-2024-26074) in vulnerable form fields, allowing injected JavaScript to run in a victim’s browser. Remediation: upgrade to 6.5.21 or later (per APSB24-28). The CVSS v3.1 base score is 5.4 (Medium). If...

CVE-2024-26106

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. The issue is triggered when a user is enticed to visit a URL referencing a vulnerable page, allowing malicious JavaScript to execute in the victim’s browser context. Pr...

CVE-2024-36158

CVE-2024-36158 affects Adobe Experience Manager 6.5.20 and earlier. A stored XSS vulnerability in vulnerable form fields can allow malicious JavaScript to run in a victim’s browser when visiting a page with the affected field. CVSSv3.1 base score 5.4 (Medium); attack vector Network, authenticatio...

CVE-2024-52840

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). The issue allows injection of malicious scripts via a manipulated DOM element from a crafted URL or user input, with exploitation requiring user interaction (the user mu...

CVE-2024-52865

Adobe Experience Manager; CVE-2024-52865 affects AEM 6.5.21 and earlier with a stored cross-site scripting (XSS) flaw in vulnerable form fields. Underlying issue: improper input handling allows injection of malicious JavaScript, which can run in a user’s browser when visiting a page containing th...

CVE-2025-46901

Adobe Experience Manager (AEM) 6.5.22 and earlier is affected by a stored cross-site scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can insert malicious scripts into these fields, with malicious JavaScript potentially executed in a victim’s browser when visitin...

CVE-2025-46949

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The issue allows a low-privileged attacker to inject malicious JavaScript that could execute in a victim’s browser when visiting the page contain...

CVE-2024-26076

Affected product/versions: Adobe Experience Manager (AEM) 6.5.19 and earlier. Vulnerability: stored Cross-Site Scripting (XSS) in vulnerable form fields (CVE-2024-26076). Impact (as described): attacker can inject malicious JavaScript, which executes in a victim’s browser when visiting the affect...

CVE-2024-26116

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a reflected Cross‑Site Scripting (XSS) vulnerability. An attacker can lure a user to a crafted URL referencing a vulnerable page, causing malicious JavaScript to execute in the victim’s browser. The issue is documented across multi...

CVE-2024-34120

Adobe Experience Manager 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing attacker-injected JavaScript to run in a victim’s browser when loading pages with the crafted input. The CVE entry for CVE-2024-34120 confirms the issu...

CVE-2024-36160

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that can inject JavaScript executed in a victim’s browser when visiting the affected page. The issue is documented as CVE-2024-36160; the connected sources...

CVE-2024-36209

CVE-2024-36209 affects Adobe Experience Manager 6.5.20 and earlier and is a stored XSS vulnerability in vulnerable form fields. An attacker could inject malicious scripts that execute in a victim’s browser when visiting the affected page, with the impact described as possible in the documents. Th...

CVE-2024-43716

CVE-2024-43716 affects Adobe Experience Manager (AEM) versions 6.5.21 and earlier, due to an Improper Access Control flaw that could bypass security features with low confidentiality impact. Exploitation does not require user interaction and could allow a low-privilege attacker to bypass protecti...

CVE-2025-46882

CVE-2025-46882 affects Adobe Experience Manager up to version 6.5.22. The vulnerability is a stored Cross-Site Scripting (XSS) in vulnerable form fields, exploitable by a low-privileged attacker to inject malicious JavaScript that executes in a victim’s browser when visiting the affected page. Pu...