CVE-2024-36226

CVE-2024-36226 affects Adobe Experience Manager 6.5.20 and earlier. The issue is an Improper Input Validation that could bypass security features and affect page integrity; exploitation requires user interaction. AEM versions prior to 6.5.21 are also noted across multiple sources as vulnerable to...

CVE-2025-47045

CVE-2025-47045 affects Adobe Experience Manager 6.5.22 and earlier with a stored XSS in vulnerable form fields. Low-privilege attackers can inject malicious scripts, leading to JavaScript execution in victims’ browsers. CVSSv3.1: 5.4 (MEDIUM). Remediation is to apply an update per APSB25-48 (or n...

CVE-2022-42351

Adobe Experience Manager (AEM) versions 6.5.14 and earlier are affected by CVE-2022-42351, an Incorrect Authorization vulnerability that allows a low-privileged attacker to disclose low-level confidential information and bypass certain security features without user interaction. Affected componen...

CVE-2022-42356

Adobe Experience Manager (AEM) 6.5.14 and earlier is affected by a reflected cross-site scripting (XSS) vulnerability. A low-privilege attacker can lure a victim to a vulnerable URL, causing malicious JavaScript to execute in the victim’s browser. The CVSS v3.1 base score is 5.4 (Medium). Remedia...

CVE-2022-44471

Adobe Experience Manager 6.5.14 and earlier are affected by CVE-2022-44471: a reflected XSS that allows a low-privileged attacker to lure a victim to a vulnerable URL and have malicious JavaScript run in the victim’s browser. The records note available security updates for AEM (APSB22-59) to addr...

CVE-2023-22266

CVE-2023-22266 affects Adobe Experience Manager 6.5.15.0 and earlier. It is a URL Redirection to Untrusted Site (Open Redirect) vulnerability allowing a low-privileged authenticated user to redirect others to malicious sites; exploitation requires user interaction. Remediation: upgrade to 6.5.16....

CVE-2024-26045

CVE-2024-26045 affects Adobe Experience Manager (AEM) 6.5.19 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious JavaScript that may run in a victim’s browser when the page with the vulnerable field is loa...

CVE-2024-36158

CVE-2024-36158 affects Adobe Experience Manager 6.5.20 and earlier. A stored XSS vulnerability in vulnerable form fields can allow malicious JavaScript to run in a victim’s browser when visiting a page with the affected field. CVSSv3.1 base score 5.4 (Medium); attack vector Network, authenticatio...

CVE-2024-36227

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a DOM-based XSS (CWE-79) that could allow an attacker to execute arbitrary JavaScript in the victim’s browser session. Exploitation typically requires user interaction (e.g., clicking a crafted link or submitting a malicious form)....

CVE-2024-53967

CVE-2024-53967 affects Adobe Experience Manager 6.5.21 and earlier, due to a DOM-based XSS flaw that allows an attacker with low privileges to cause arbitrary code execution in the victim’s browser after user interaction. The issue stems from insufficient input handling in the DOM environment. Af...

CVE-2024-53969

Adobe Experience Manager (AEM) 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue arises from DOM manipulation in the victim’s browser, allowing a low-privilege attacker to inject scripts that execute in the user’s browser session. Exploitation requ...

CVE-2022-42360

Adobe Experience Manager 6.5.14 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker with low privileges can lure a victim to a URL referencing a vulnerable page, allowing malicious JavaScript to run in the victim’s browser. The issue is documented in CVE-...

CVE-2023-29302

CVE-2023-29302 affects Adobe Experience Manager versions ≤ 6.5.16.0. The vulnerability is a reflected Cross-Site Scripting (XSS) flaw: if a low-privileged user is persuaded to visit a crafted URL referencing a vulnerable AEM page, malicious JavaScript can execute in the victim’s browser. The issu...

CVE-2024-26054

CVE-2024-26054 affects Adobe Experience Manager (AEM) 6.5.20 and earlier, with a stored Cross-Site Scripting (XSS) vulnerability that lets an attacker inject malicious scripts into vulnerable form fields, causing malicious JavaScript to run in a victim’s browser when visiting a page containing th...

CVE-2024-26073

CVE-2024-26073 affects Adobe Experience Manager (AEM) 6.5.19 and earlier, with a stored XSS vulnerability in vulnerable form fields that can inject malicious JavaScript executed in a victim’s browser when visiting the page containing the field. The exploitation requires user interaction and is ti...

CVE-2024-26122

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability tracked as CVE-2024-26122. The issue occurs in vulnerable form fields where attacker-supplied input is stored and later rendered in a victim’s browser, enabling injection o...

CVE-2024-52840

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). The issue allows injection of malicious scripts via a manipulated DOM element from a crafted URL or user input, with exploitation requiring user interaction (the user mu...

CVE-2022-44470

CVE-2022-44470 affects Adobe Experience Manager (AEM) 6.5.14 and earlier. It is a reflected Cross-Site Scripting (XSS) vulnerability: if a low-privileged user is induced to visit a URL referencing a vulnerable page, a victim’s browser may execute malicious JavaScript. The issue is explicitly desc...

CVE-2024-26046

CVE-2024-26046 affects Adobe Experience Manager up to version 6.5.19 (and earlier). It is a stored Cross‑Site Scripting (XSS) vulnerability where malicious JavaScript can be injected into vulnerable form fields and executed in a victim’s browser when visiting the affected page. Remediation: upgra...

CVE-2024-36231

CVE-2024-36231 affects Adobe Experience Manager versions 6.5.20 and earlier, with a DOM-based XSS vulnerability that could allow arbitrary JavaScript execution in the victim’s browser session. Exploitation typically requires user interaction (e.g., clicking a crafted link or submitting a form). T...

CVE-2024-36234

Adobe Experience Manager (AEM)

CVE-2024-53960

Adobe Experience Manager (AEM) versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious JavaScript that executes in a victim’s browser when visiting the affected page. The issue is documented ...

CVE-2024-53968

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based XSS vulnerability that could allow an attacker to execute arbitrary code in the victim’s browser. The issue arises from how the DOM environment is manipulated in the victim’s browser, enabling a low‑privileged attacker t...

CVE-2025-46917

Adobe Experience Manager (AEM) prior to 6.5.23 is affected by a stored XSS in vulnerable form fields (CVE-2025-46917). A low-privilege attacker can inject malicious scripts, with exploitation requiring user interaction and potentially changing confidentiality/integrity impacts. Remediation per AP...

CVE-2025-46991

CVE-2025-46991 affects Adobe Experience Manager 6.5.22 and earlier with a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker could inject JavaScript and have it execute in a victim’s browser when visiting the page containing the field. The issue i...

CVE-2022-42349

Summary: CVE-2022-42349 affects Adobe Experience Manager (AEM) 6.5.14 and earlier. The issue is a reflected Cross‑Site Scripting (XSS) vulnerability that can execute malicious JavaScript in a victim’s browser if the user visits a crafted URL referencing a vulnerable page. Impact details : attacke...

CVE-2023-22262

Adobe Experience Manager (AEM) 6.5.15.0 and earlier is affected by a URL redirection to an untrusted site (open redirect). An attacker with low-privilege authenticated access can leverage this to redirect users to malicious websites, with user interaction required. The issue is listed across mult...

CVE-2024-26091

CVE-2024-26091 is a DOM-based XSS affecting Adobe Experience Manager 6.5.20 and earlier. The issue could allow an attacker to run arbitrary JavaScript in the victim’s browser, typically requiring user interaction. The connected advisories indicate Adobe released updates (APSB24-28) to address vul...

CVE-2024-26098

CVE-2024-26098 affects Adobe Experience Manager (AEM) 6.5.19 and earlier. The vulnerability is a stored Cross-Site Scripting (XSS) in vulnerable form fields, allowing an attacker to inject malicious scripts that may execute in a victim’s browser when visiting a page containing the affected field....

CVE-2025-46949

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The issue allows a low-privileged attacker to inject malicious JavaScript that could execute in a victim’s browser when visiting the page contain...

CVE-2025-47114

CVE-2025-47114 describes a stored XSS in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability allows a low-privileged attacker to inject malicious scripts into vulnerable form fields, which execute in a victim’s browser when visiting the affected page. Public details in c...

CVE-2022-42365

CVE-2022-42365 – AEM reflected XSS : Adobe Experience Manager 6.5.14 and earlier is vulnerable to a reflected Cross-Site Scripting attack. A low-privilege attacker can trick a user into visiting a URL referencing a vulnerable page, causing malicious JavaScript to execute in the user’s browser con...

CVE-2023-22259

The CVE-2023-22259 issue affects Adobe Experience Manager versions 6.5.15.0 and earlier, where an Open Redirect vulnerability allows a low-privilege authenticated user to redirect victims to malicious sites. The exploit requires user interaction, and the vulnerable component is the URL redirectio...

CVE-2024-26079

CVE-2024-26079 affects Adobe Experience Manager 6.5.19 and earlier, with a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. Malicious JavaScript could execute in a user’s browser when visiting a page containing the affected field. The weakness is documented across multip...

CVE-2025-46899

Adobe Experience Manager 6.5.22 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. A low‑privileged attacker, with user interaction, can inject malicious JavaScript executed in a victim’s browser when visiting the vulnerable page. remediation:...

CVE-2022-42354

CVE-2022-42354 describes a reflected XSS in Adobe Experience Manager (AEM) 6.5.14 and earlier: a low-privileged attacker can convince a victim to visit a crafted URL, causing arbitrary JavaScript to run in the victim’s browser. Connected sources confirm this is an AEM page-context XSS vulnerabili...

CVE-2022-44466

Adobe Experience Manager (AEM) 6.5.14 and earlier is affected by a reflected XSS vulnerability (CVE-2022-44466). Exploitation requires a low-privileged attacker to entice a victim to visit a crafted URL, allowing malicious JavaScript to run in the victim’s browser. Impact is limited to the affect...

CVE-2024-26039

CVE-2024-26039 : Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue could allow an attacker to execute arbitrary JavaScript in the victim’s browser session, with exploitation typically requiring user interacti...

CVE-2024-26110

Adobe Experience Manager 6.5.20 and earlier are affected by a stored XSS in vulnerable form fields. An attacker can inject script and have it execute in a victim’s browser when visiting the page containing the field. The issue stems from improper validation of user input. Adobe has released updat...

CVE-2024-36160

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that can inject JavaScript executed in a victim’s browser when visiting the affected page. The issue is documented as CVE-2024-36160; the connected sources...

CVE-2024-52865

Adobe Experience Manager; CVE-2024-52865 affects AEM 6.5.21 and earlier with a stored cross-site scripting (XSS) flaw in vulnerable form fields. Underlying issue: improper input handling allows injection of malicious JavaScript, which can run in a user’s browser when visiting a page containing th...

CVE-2024-20778

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing injected JavaScript to run in a victim’s browser when visiting pages containing those fields. The issue is a stored XSS (CWE-79) and is ...

CVE-2024-26029

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability (CVE-2024-26029) that could bypass security features and disclose information. The issue is network-accessible with no user interaction required, as described in NVD and CVE records...

CVE-2024-26057

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary JavaScript in a victim’s browser. Exploitation typically requires user interaction (e.g., clicking a crafted link or su...

CVE-2024-26074

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored XSS vulnerability (CVE-2024-26074) in vulnerable form fields, allowing injected JavaScript to run in a victim’s browser. Remediation: upgrade to 6.5.21 or later (per APSB24-28). The CVSS v3.1 base score is 5.4 (Medium). If...

CVE-2024-26076

Affected product/versions: Adobe Experience Manager (AEM) 6.5.19 and earlier. Vulnerability: stored Cross-Site Scripting (XSS) in vulnerable form fields (CVE-2024-26076). Impact (as described): attacker can inject malicious JavaScript, which executes in a victim’s browser when visiting the affect...

CVE-2024-26084

CVE-2024-26084 affects Adobe Experience Manager (AEM) versions 6.5.19 and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser when the page containing the field is loaded. A...

CVE-2024-26106

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. The issue is triggered when a user is enticed to visit a URL referencing a vulnerable page, allowing malicious JavaScript to execute in the victim’s browser context. Pr...

CVE-2024-36238

Adobe Experience Manager up to version 6.5.20 is affected by a DOM-based XSS vulnerability that can allow an attacker to execute arbitrary JavaScript in the victim’s browser session. Exploitation typically requires user interaction (e.g., clicking a malicious link or interacting with crafted cont...

CVE-2024-52860

Adobe Experience Manager (AEM) v6.5.21 and earlier is affected by a DOM-based XSS vulnerability (CVE-2024-52860). The issue allows an attacker to execute arbitrary code in the victim’s browser context by manipulating a DOM element via a crafted URL or user input; exploitation requires user intera...