CVE-2024-26037

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a DOM-based XSS vulnerability (CVE-2024-26037) that could allow arbitrary JavaScript execution in a victim’s browser, with exploitation typically requiring user interaction. Connected sources indicate fixes in the APSB24-2...

CVE-2024-26046

CVE-2024-26046 affects Adobe Experience Manager up to version 6.5.19 (and earlier). It is a stored Cross‑Site Scripting (XSS) vulnerability where malicious JavaScript can be injected into vulnerable form fields and executed in a victim’s browser when visiting the affected page. Remediation: upgra...

CVE-2024-26102

CVE-2024-26102 affects Adobe Experience Manager (AEM) 6.5.19 and earlier and is a reflected XSS vulnerability. The issue permits executing malicious JavaScript in a victim’s browser if a crafted URL references a vulnerable page. The vulnerability is documented with a Medium severity (CVSS 3.1: 5....

CVE-2022-42356

Adobe Experience Manager (AEM) 6.5.14 and earlier is affected by a reflected cross-site scripting (XSS) vulnerability. A low-privilege attacker can lure a victim to a vulnerable URL, causing malicious JavaScript to execute in the victim’s browser. The CVSS v3.1 base score is 5.4 (Medium). Remedia...

CVE-2022-42365

CVE-2022-42365 – AEM reflected XSS : Adobe Experience Manager 6.5.14 and earlier is vulnerable to a reflected Cross-Site Scripting attack. A low-privilege attacker can trick a user into visiting a URL referencing a vulnerable page, causing malicious JavaScript to execute in the user’s browser con...

CVE-2023-22262

Adobe Experience Manager (AEM) 6.5.15.0 and earlier is affected by a URL redirection to an untrusted site (open redirect). An attacker with low-privilege authenticated access can leverage this to redirect users to malicious websites, with user interaction required. The issue is listed across mult...

CVE-2024-26045

CVE-2024-26045 affects Adobe Experience Manager (AEM) 6.5.19 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious JavaScript that may run in a victim’s browser when the page with the vulnerable field is loa...

CVE-2024-26122

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability tracked as CVE-2024-26122. The issue occurs in vulnerable form fields where attacker-supplied input is stored and later rendered in a victim’s browser, enabling injection o...

CVE-2024-36227

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a DOM-based XSS (CWE-79) that could allow an attacker to execute arbitrary JavaScript in the victim’s browser session. Exploitation typically requires user interaction (e.g., clicking a crafted link or submitting a malicious form)....

CVE-2024-36230

CVE-2024-36230 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier. The issue is a DOM-based Cross-Site Scripting (XSS) vulnerability that could let an attacker run arbitrary JavaScript in a victim’s browser context. Exploitation normally requires user interaction (e.g., clicking a...

CVE-2025-46917

Adobe Experience Manager (AEM) prior to 6.5.23 is affected by a stored XSS in vulnerable form fields (CVE-2025-46917). A low-privilege attacker can inject malicious scripts, with exploitation requiring user interaction and potentially changing confidentiality/integrity impacts. Remediation per AP...

CVE-2022-44470

CVE-2022-44470 affects Adobe Experience Manager (AEM) 6.5.14 and earlier. It is a reflected Cross-Site Scripting (XSS) vulnerability: if a low-privileged user is induced to visit a URL referencing a vulnerable page, a victim’s browser may execute malicious JavaScript. The issue is explicitly desc...

CVE-2022-44471

Adobe Experience Manager 6.5.14 and earlier are affected by CVE-2022-44471: a reflected XSS that allows a low-privileged attacker to lure a victim to a vulnerable URL and have malicious JavaScript run in the victim’s browser. The records note available security updates for AEM (APSB22-59) to addr...

CVE-2023-29302

CVE-2023-29302 affects Adobe Experience Manager versions ≤ 6.5.16.0. The vulnerability is a reflected Cross-Site Scripting (XSS) flaw: if a low-privileged user is persuaded to visit a crafted URL referencing a vulnerable AEM page, malicious JavaScript can execute in the victim’s browser. The issu...

CVE-2024-26033

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The root cause is a stored XSS condition that could allow an attacker to inject malicious JavaScript, which may execute in a user’s browser when ...

CVE-2024-26058

CVE-2024-26058 affects Adobe Experience Manager 6.5.20 and earlier with a DOM-based XSS that can execute JavaScript in the victim’s browser after user interaction. The CVSSv3.1 base score is 5.4 (Medium). Multiple connected documents confirm this family of issues and that Adobe released fixes via...

CVE-2024-26079

CVE-2024-26079 affects Adobe Experience Manager 6.5.19 and earlier, with a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. Malicious JavaScript could execute in a user’s browser when visiting a page containing the affected field. The weakness is documented across multip...

CVE-2024-26091

CVE-2024-26091 is a DOM-based XSS affecting Adobe Experience Manager 6.5.20 and earlier. The issue could allow an attacker to run arbitrary JavaScript in the victim’s browser, typically requiring user interaction. The connected advisories indicate Adobe released updates (APSB24-28) to address vul...

CVE-2024-36158

CVE-2024-36158 affects Adobe Experience Manager 6.5.20 and earlier. A stored XSS vulnerability in vulnerable form fields can allow malicious JavaScript to run in a victim’s browser when visiting a page with the affected field. CVSSv3.1 base score 5.4 (Medium); attack vector Network, authenticatio...

CVE-2024-36231

CVE-2024-36231 affects Adobe Experience Manager versions 6.5.20 and earlier, with a DOM-based XSS vulnerability that could allow arbitrary JavaScript execution in the victim’s browser session. Exploitation typically requires user interaction (e.g., clicking a crafted link or submitting a form). T...

CVE-2024-36234

Adobe Experience Manager (AEM)

CVE-2024-53969

Adobe Experience Manager (AEM) 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue arises from DOM manipulation in the victim’s browser, allowing a low-privilege attacker to inject scripts that execute in the user’s browser session. Exploitation requ...

CVE-2025-46882

CVE-2025-46882 affects Adobe Experience Manager up to version 6.5.22. The vulnerability is a stored Cross-Site Scripting (XSS) in vulnerable form fields, exploitable by a low-privileged attacker to inject malicious JavaScript that executes in a victim’s browser when visiting the affected page. Pu...

CVE-2025-46899

Adobe Experience Manager 6.5.22 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. A low‑privileged attacker, with user interaction, can inject malicious JavaScript executed in a victim’s browser when visiting the vulnerable page. remediation:...

CVE-2022-35695

CVE-2022-35695 affects Adobe Experience Manager (AEM) versions 6.5.14 and earlier, with a reflected XSS vulnerability that can cause malicious JavaScript to execute in a victim’s browser when a user is lured to a crafted URL. Exploitation requires user interaction and low privileges. Affected com...

CVE-2022-42349

Summary: CVE-2022-42349 affects Adobe Experience Manager (AEM) 6.5.14 and earlier. The issue is a reflected Cross‑Site Scripting (XSS) vulnerability that can execute malicious JavaScript in a victim’s browser if the user visits a crafted URL referencing a vulnerable page. Impact details : attacke...

CVE-2024-26073

CVE-2024-26073 affects Adobe Experience Manager (AEM) 6.5.19 and earlier, with a stored XSS vulnerability in vulnerable form fields that can inject malicious JavaScript executed in a victim’s browser when visiting the page containing the field. The exploitation requires user interaction and is ti...

CVE-2024-53967

CVE-2024-53967 affects Adobe Experience Manager 6.5.21 and earlier, due to a DOM-based XSS flaw that allows an attacker with low privileges to cause arbitrary code execution in the victim’s browser after user interaction. The issue stems from insufficient input handling in the DOM environment. Af...

CVE-2024-53968

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based XSS vulnerability that could allow an attacker to execute arbitrary code in the victim’s browser. The issue arises from how the DOM environment is manipulated in the victim’s browser, enabling a low‑privileged attacker t...

CVE-2025-46991

CVE-2025-46991 affects Adobe Experience Manager 6.5.22 and earlier with a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker could inject JavaScript and have it execute in a victim’s browser when visiting the page containing the field. The issue i...

CVE-2024-52840

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). The issue allows injection of malicious scripts via a manipulated DOM element from a crafted URL or user input, with exploitation requiring user interaction (the user mu...

CVE-2024-36209

CVE-2024-36209 affects Adobe Experience Manager 6.5.20 and earlier and is a stored XSS vulnerability in vulnerable form fields. An attacker could inject malicious scripts that execute in a victim’s browser when visiting the affected page, with the impact described as possible in the documents. Th...

CVE-2024-53960

Adobe Experience Manager (AEM) versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious JavaScript that executes in a victim’s browser when visiting the affected page. The issue is documented ...

CVE-2025-46949

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The issue allows a low-privileged attacker to inject malicious JavaScript that could execute in a victim’s browser when visiting the page contain...

CVE-2022-44466

Adobe Experience Manager (AEM) 6.5.14 and earlier is affected by a reflected XSS vulnerability (CVE-2022-44466). Exploitation requires a low-privileged attacker to entice a victim to visit a crafted URL, allowing malicious JavaScript to run in the victim’s browser. Impact is limited to the affect...

CVE-2024-26029

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability (CVE-2024-26029) that could bypass security features and disclose information. The issue is network-accessible with no user interaction required, as described in NVD and CVE records...

CVE-2024-26098

CVE-2024-26098 affects Adobe Experience Manager (AEM) 6.5.19 and earlier. The vulnerability is a stored Cross-Site Scripting (XSS) in vulnerable form fields, allowing an attacker to inject malicious scripts that may execute in a victim’s browser when visiting a page containing the affected field....

CVE-2024-26106

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. The issue is triggered when a user is enticed to visit a URL referencing a vulnerable page, allowing malicious JavaScript to execute in the victim’s browser context. Pr...

CVE-2024-26110

Adobe Experience Manager 6.5.20 and earlier are affected by a stored XSS in vulnerable form fields. An attacker can inject script and have it execute in a victim’s browser when visiting the page containing the field. The issue stems from improper validation of user input. Adobe has released updat...

CVE-2024-36160

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that can inject JavaScript executed in a victim’s browser when visiting the affected page. The issue is documented as CVE-2024-36160; the connected sources...

CVE-2024-43716

CVE-2024-43716 affects Adobe Experience Manager (AEM) versions 6.5.21 and earlier, due to an Improper Access Control flaw that could bypass security features with low confidentiality impact. Exploitation does not require user interaction and could allow a low-privilege attacker to bypass protecti...

CVE-2024-43737

CVE-2024-43737 affects Adobe Experience Manager (AEM) 6.5.21 and earlier. The vulnerability is a stored Cross-Site Scripting (XSS) flaw in vulnerable form fields, enabling an attacker to inject malicious JavaScript that runs in a victim’s browser when loading the affected page. Public-facing sour...

CVE-2024-53970

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a stored XSS vulnerability in vulnerable form fields. The issue allows a low‑privileged attacker to inject malicious scripts that execute in a victim’s browser when they visit the affected page. The CVE entry is supported by multipl...

CVE-2025-46997

Adobe Experience Manager (AEM) 6.5.22 and earlier is affected by a stored XSS vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious scripts, which may execute in a victim’s browser when visiting the affected page. The issue’s impact is consistent with stored XSS ...

CVE-2025-47094

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a reflected Cross‑Site Scripting (XSS) vulnerability. The issue allows an attacker to entice a victim to visit a URL referencing a vulnerable page, causing malicious JavaScript to execute in the victim’s browser. The explo...

CVE-2025-47113

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious scripts, which are executed in the victim’s browser when visiting the page containing the field. R...

CVE-2025-47114

CVE-2025-47114 describes a stored XSS in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability allows a low-privileged attacker to inject malicious scripts into vulnerable form fields, which execute in a victim’s browser when visiting the affected page. Public details in c...

CVE-2023-22259

The CVE-2023-22259 issue affects Adobe Experience Manager versions 6.5.15.0 and earlier, where an Open Redirect vulnerability allows a low-privilege authenticated user to redirect victims to malicious sites. The exploit requires user interaction, and the vulnerable component is the URL redirectio...

CVE-2024-26076

Affected product/versions: Adobe Experience Manager (AEM) 6.5.19 and earlier. Vulnerability: stored Cross-Site Scripting (XSS) in vulnerable form fields (CVE-2024-26076). Impact (as described): attacker can inject malicious JavaScript, which executes in a victim’s browser when visiting the affect...

CVE-2024-26084

CVE-2024-26084 affects Adobe Experience Manager (AEM) versions 6.5.19 and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser when the page containing the field is loaded. A...