CVE-2025-46995

CVE-2025-46995 is a stored Cross-Site Scripting (XSS) flaw in Adobe Experience Manager versions up to 6.5.22. A low-privilege attacker can inject malicious scripts into vulnerable form fields, causing JavaScript to execute in the victim’s browser when loading the page. Public details are supporte...

CVE-2025-47036

CVE-2025-47036 affects Adobe Experience Manager 6.5.22 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, which could allow a low-privileged attacker to inject malicious JavaScript that runs in a victim’s browser when visiting the affected page....

CVE-2024-26074

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored XSS vulnerability (CVE-2024-26074) in vulnerable form fields, allowing injected JavaScript to run in a victim’s browser. Remediation: upgrade to 6.5.21 or later (per APSB24-28). The CVSS v3.1 base score is 5.4 (Medium). If...

CVE-2024-36222

CVE-2024-36222 affects Adobe Experience Manager 6.5.20 and earlier, introducing a DOM-based XSS vulnerability that can execute arbitrary JavaScript in the victim’s browser after user interaction. The issue is documented across multiple sources (NVD/CVE records) with a CVSSv3.1 base score of 5.4 (...

CVE-2024-43733

CVE-2024-43733 affects Adobe Experience Manager (AEM) 6.5.21 and earlier with a DOM-based Cross-Site Scripting (XSS) flaw. The vulnerability allows injection of malicious scripts via manipulated DOM elements using crafted URLs or user input, executing in the victim’s browser context and requiring...

CVE-2024-49523

Adobe Experience Manager (AEM) 6.5.20 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. An attacker can inject malicious JavaScript that may execute in a victim’s browser when visiting pages containing the affected field. The issue is document...

CVE-2024-52862

CVE-2024-52862 affects Adobe Experience Manager 6.5.21 and earlier with a stored XSS in vulnerable form fields. Root cause: improper handling of input leading to persistent script execution in victims’ browsers. Impact: potential attacker‑supplied scripts execute when a user visits a page contain...

CVE-2025-46901

Adobe Experience Manager (AEM) 6.5.22 and earlier is affected by a stored cross-site scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can insert malicious scripts into these fields, with malicious JavaScript potentially executed in a victim’s browser when visitin...

CVE-2024-34120

Adobe Experience Manager 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing attacker-injected JavaScript to run in a victim’s browser when loading pages with the crafted input. The CVE entry for CVE-2024-34120 confirms the issu...

CVE-2024-36209

CVE-2024-36209 affects Adobe Experience Manager 6.5.20 and earlier and is a stored XSS vulnerability in vulnerable form fields. An attacker could inject malicious scripts that execute in a victim’s browser when visiting the affected page, with the impact described as possible in the documents. Th...

CVE-2024-36228

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. Root cause is DOM-based XSS that can lead to execution of arbitrary JavaScript in the victim’s browser session, typically requiring user interaction (e.g., clicking a c...

CVE-2024-43737

CVE-2024-43737 affects Adobe Experience Manager (AEM) 6.5.21 and earlier. The vulnerability is a stored Cross-Site Scripting (XSS) flaw in vulnerable form fields, enabling an attacker to inject malicious JavaScript that runs in a victim’s browser when loading the affected page. Public-facing sour...

CVE-2024-52849

CVE-2024-52849 pertains to Adobe Experience Manager (AEM) and is a stored Cross-Site Scripting (XSS) vulnerability affecting AEM 6.5.21 and earlier. The issue is triggered when malicious input is submitted into vulnerable form fields, allowing JavaScript to execute in a victim’s browser upon page...

CVE-2025-46882

CVE-2025-46882 affects Adobe Experience Manager up to version 6.5.22. The vulnerability is a stored Cross-Site Scripting (XSS) in vulnerable form fields, exploitable by a low-privileged attacker to inject malicious JavaScript that executes in a victim’s browser when visiting the affected page. Pu...

CVE-2025-46997

Adobe Experience Manager (AEM) 6.5.22 and earlier is affected by a stored XSS vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious scripts, which may execute in a victim’s browser when visiting the affected page. The issue’s impact is consistent with stored XSS ...

CVE-2025-47077

CVE-2025-47077 concerns Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability is a stored Cross-Site Scripting (XSS) issue caused by improper validation of user-supplied input in vulnerable form fields. A low-privileged attacker could inject malicious scripts, which may be...

CVE-2025-47086

Adobe Experience Manager (AEM) exposes CVE-2025-47086: a stored Cross-Site Scripting (XSS) vulnerability in AEM 6.5.22 and earlier. A low-privilege attacker can inject malicious scripts via vulnerable form fields, with JavaScript potentially executing in the victim’s browser when loading the page...

CVE-2025-47113

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious scripts, which are executed in the victim’s browser when visiting the page containing the field. R...

CVE-2023-22253

CVE-2023-22253 pertains to Adobe Experience Manager (AEM) 6.5.15.0 and earlier, with a reflected XSS vulnerability. A low-privilege attacker can lure a user to a crafted URL referencing a vulnerable page, causing malicious JavaScript to execute in the user’s browser. The CVE is included in the AP...

CVE-2024-20780

CVE-2024-20780 affects Adobe Experience Manager (AEM) versions 6.5.19 and earlier. A stored Cross-Site Scripting (XSS) vulnerability exists in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser when visiting a page containing the vulnerable...

CVE-2024-26049

Adobe Experience Manager 6.5.20 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. The issue can be exploited by a privileged attacker to inject malicious scripts, with the attacker needing user interaction and elevated privileges (per CVSS: H...

CVE-2024-26121

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The underlying issue allows an attacker to inject malicious scripts that may be executed in a victim’s browser when visiting a page containing the vulnera...

CVE-2024-36157

CVE-2024-36157 affects Adobe Experience Manager 6.5.20 and earlier, with a stored XSS vulnerability that could inject malicious scripts into vulnerable form fields, executing in the victim’s browser. Multiple connected sources confirm this XSS issue and a patch path: Adobe APSB24-28 provides fixe...

CVE-2024-36162

CVE-2024-36162 affects Adobe Experience Manager (AEM) 6.5.20 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser when they visit the affected page. The vulnerabil...

CVE-2024-36220

CVE-2024-36220 affects Adobe Experience Manager (AEM) 6.5.20 and earlier. The issue is a DOM-based Cross-Site Scripting (XSS) vulnerability that can allow an attacker to execute arbitrary JavaScript within the victim’s browser session, typically requiring user interaction (e.g., clicking a crafte...

CVE-2024-41841

CVE-2024-41841 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier, with a reflected XSS vulnerability that can execute malicious JavaScript in a victim’s browser when a user visits a crafted URL. The issue is confirmed in multiple sources and is exploitable via a vulnerable page r...

CVE-2024-41842

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. The issue allows an attacker to inject malicious JavaScript, which may execute in a victim’s browser when they visit a page containing the exploi...

CVE-2024-43715

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based XSS vulnerability (CVE-2024-43715). The issue arises from unsanitized DOM handling, allowing an attacker to inject and execute scripts in the victim’s browser when a crafted URL or input is used. The vulnerability requir...

CVE-2024-43721

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2024-43721). An attacker can manipulate a DOM element via a crafted URL or user input to execute malicious scripts in the victim’s browser; exploitation requires user interac...

CVE-2024-52993

Adobe Experience Manager has a stored Cross-Site Scripting (XSS) vulnerability affecting versions 6.5.21 and earlier. The flaw resides in vulnerable form fields, allowing an attacker to inject malicious JavaScript that executes in a victim’s browser when visiting the affected page. Public sources...

CVE-2025-47094

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a reflected Cross‑Site Scripting (XSS) vulnerability. The issue allows an attacker to entice a victim to visit a URL referencing a vulnerable page, causing malicious JavaScript to execute in the victim’s browser. The explo...

CVE-2024-20768

CVE-2024-20768 is a stored XSS in Adobe Experience Manager (AEM) 6.5.19 and earlier. The vulnerability allows injected JavaScript in vulnerable form fields, which executes in a victim’s browser when loading the page containing the field. Affected product/versions: AEM 6.5.19 and earlier. Root cau...

CVE-2024-26116

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a reflected Cross‑Site Scripting (XSS) vulnerability. An attacker can lure a user to a crafted URL referencing a vulnerable page, causing malicious JavaScript to execute in the victim’s browser. The issue is documented across multi...

CVE-2024-36235

CVE-2024-36235 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier, due to a DOM-based XSS vulnerability that can lead to arbitrary JavaScript execution in a victim’s browser when a user interacts with crafted content. Exploitation requires user interaction. The issue is addressed ...

CVE-2024-41843

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The underlying issue is improper input handling in certain pages, allowing attacker-supplied scripts to execute in a victim’s browser when the page contai...

CVE-2024-43752

CVE-2024-43752 affects Adobe Experience Manager (AEM) 6.5.21 and earlier. The vulnerability is a stored Cross-Site Scripting (XSS) in vulnerable form fields, allowing attacker-controlled JavaScript to run in a victim’s browser when visiting a page containing the vulnerable field. The published sc...

CVE-2025-46954

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that could allow a low-privileged attacker to inject malicious JavaScript executed in a victim’s browser. The available connected documents identify the...

CVE-2025-47052

Adobe Experience Manager (AEM) 6.5.22 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The issue can be exploited by a low-privileged attacker to inject malicious JavaScript, which may execute in a victim’s browser when loading the page conta...

CVE-2024-36211

CVE-2024-36211 affects Adobe Experience Manager (AEM) 6.5.20 and earlier, with a reflected cross-site scripting (XSS) vulnerability. A low-privilege attacker can lure a victim to a URL that references a vulnerable page, causing malicious JavaScript to execute in the victim’s browser. The vulnerab...

CVE-2024-43712

Adobe Experience Manager (AEM) versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2024-43712), where unsanitized data from a user-controllable source is used in the DOM, enabling arbitrary script execution in the victim's browser. Exploitation re...

CVE-2024-43716

CVE-2024-43716 affects Adobe Experience Manager (AEM) versions 6.5.21 and earlier, due to an Improper Access Control flaw that could bypass security features with low confidentiality impact. Exploitation does not require user interaction and could allow a low-privilege attacker to bypass protecti...

CVE-2024-43735

CVE-2024-43735 affects Adobe Experience Manager (AEM) 6.5.21 and earlier with a reflected Cross-Site Scripting (XSS) vulnerability that can execute malicious JavaScript in a victim’s browser when a user visits a crafted URL referencing a vulnerable page. The CVSS vector indicates Network access, ...

CVE-2024-52850

CVE-2024-52850 affects Adobe Experience Manager (AEM) 6.5.21 and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability where malicious JavaScript can be injected into vulnerable form fields and executed in a victim’s browser when visiting the affected page. The primary published detail...

CVE-2025-46840

Adobe Experience Manager (AEM) up to version 6.5.22 is affected by an Improper Authorization vulnerability (CVE-2025-46840). The issue could allow a low-privileged attacker to bypass security and escalate privileges, potentially enabling session takeover. Exploitation requires user interaction, a...

CVE-2023-22258

Adobe Experience Manager (AEM) 6.5.x up to 6.5.15.0 is affected by a URL redirection to an untrusted site (open redirect) vulnerability. A low-privilege authenticated attacker can cause a user-to-malicious-site redirect, with exploitation requiring user interaction. The issue is addressed in Adob...

CVE-2023-51462

Adobe Experience Manager 6.5.18 and earlier is affected by a reflected Cross‑Site Scripting (XSS) vulnerability. A low‑privileged attacker must entice a victim to visit a URL referencing a vulnerable page, which may cause arbitrary JavaScript to execute in the victim’s browser. CVSS v3.1 base sco...

CVE-2024-26055

CVE-2024-26055 affects Adobe Experience Manager 6.5.20 and earlier with a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue could allow an attacker to run arbitrary JavaScript in the victim’s browser context, typically requiring user interaction (e.g., clicking a crafted link or submi...

CVE-2024-26088

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser. The issue stems from the DOM/storage of user-provided input ...

CVE-2024-26089

CVE-2024-26089 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier and is described as a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) that could allow an attacker to execute arbitrary JavaScript in a victim’s browser context. The exploitation requires user interactio...

CVE-2024-26090

CVE-2024-26090 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier. The vulnerability is DOM-based XSS that could allow arbitrary JavaScript execution in the victim’s browser if a user interacts with a crafted payload (e.g., clicking a link). CVSS v3.1 base metrics indicate a MEDIU...