CVE-2024-26076

Affected product/versions: Adobe Experience Manager (AEM) 6.5.19 and earlier. Vulnerability: stored Cross-Site Scripting (XSS) in vulnerable form fields (CVE-2024-26076). Impact (as described): attacker can inject malicious JavaScript, which executes in a victim’s browser when visiting the affect...

CVE-2024-26084

CVE-2024-26084 affects Adobe Experience Manager (AEM) versions 6.5.19 and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser when the page containing the field is loaded. A...

CVE-2024-34120

Adobe Experience Manager 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing attacker-injected JavaScript to run in a victim’s browser when loading pages with the crafted input. The CVE entry for CVE-2024-34120 confirms the issu...

CVE-2024-36222

CVE-2024-36222 affects Adobe Experience Manager 6.5.20 and earlier, introducing a DOM-based XSS vulnerability that can execute arbitrary JavaScript in the victim’s browser after user interaction. The issue is documented across multiple sources (NVD/CVE records) with a CVSSv3.1 base score of 5.4 (...

CVE-2024-36228

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. Root cause is DOM-based XSS that can lead to execution of arbitrary JavaScript in the victim’s browser session, typically requiring user interaction (e.g., clicking a c...

CVE-2024-41842

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. The issue allows an attacker to inject malicious JavaScript, which may execute in a victim’s browser when they visit a page containing the exploi...

CVE-2024-52862

CVE-2024-52862 affects Adobe Experience Manager 6.5.21 and earlier with a stored XSS in vulnerable form fields. Root cause: improper handling of input leading to persistent script execution in victims’ browsers. Impact: potential attacker‑supplied scripts execute when a user visits a page contain...

CVE-2024-52865

Adobe Experience Manager; CVE-2024-52865 affects AEM 6.5.21 and earlier with a stored cross-site scripting (XSS) flaw in vulnerable form fields. Underlying issue: improper input handling allows injection of malicious JavaScript, which can run in a user’s browser when visiting a page containing th...

CVE-2025-46901

Adobe Experience Manager (AEM) 6.5.22 and earlier is affected by a stored cross-site scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can insert malicious scripts into these fields, with malicious JavaScript potentially executed in a victim’s browser when visitin...

CVE-2025-46995

CVE-2025-46995 is a stored Cross-Site Scripting (XSS) flaw in Adobe Experience Manager versions up to 6.5.22. A low-privilege attacker can inject malicious scripts into vulnerable form fields, causing JavaScript to execute in the victim’s browser when loading the page. Public details are supporte...

CVE-2025-47036

CVE-2025-47036 affects Adobe Experience Manager 6.5.22 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, which could allow a low-privileged attacker to inject malicious JavaScript that runs in a victim’s browser when visiting the affected page....

CVE-2022-42354

CVE-2022-42354 describes a reflected XSS in Adobe Experience Manager (AEM) 6.5.14 and earlier: a low-privileged attacker can convince a victim to visit a crafted URL, causing arbitrary JavaScript to run in the victim’s browser. Connected sources confirm this is an AEM page-context XSS vulnerabili...

CVE-2024-20768

CVE-2024-20768 is a stored XSS in Adobe Experience Manager (AEM) 6.5.19 and earlier. The vulnerability allows injected JavaScript in vulnerable form fields, which executes in a victim’s browser when loading the page containing the field. Affected product/versions: AEM 6.5.19 and earlier. Root cau...

CVE-2024-20778

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing injected JavaScript to run in a victim’s browser when visiting pages containing those fields. The issue is a stored XSS (CWE-79) and is ...

CVE-2024-26057

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could allow an attacker to execute arbitrary JavaScript in a victim’s browser. Exploitation typically requires user interaction (e.g., clicking a crafted link or su...

CVE-2024-36211

CVE-2024-36211 affects Adobe Experience Manager (AEM) 6.5.20 and earlier, with a reflected cross-site scripting (XSS) vulnerability. A low-privilege attacker can lure a victim to a URL that references a vulnerable page, causing malicious JavaScript to execute in the victim’s browser. The vulnerab...

CVE-2024-36238

Adobe Experience Manager up to version 6.5.20 is affected by a DOM-based XSS vulnerability that can allow an attacker to execute arbitrary JavaScript in the victim’s browser session. Exploitation typically requires user interaction (e.g., clicking a malicious link or interacting with crafted cont...

CVE-2024-41841

CVE-2024-41841 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier, with a reflected XSS vulnerability that can execute malicious JavaScript in a victim’s browser when a user visits a crafted URL. The issue is confirmed in multiple sources and is exploitable via a vulnerable page r...

CVE-2024-43715

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based XSS vulnerability (CVE-2024-43715). The issue arises from unsanitized DOM handling, allowing an attacker to inject and execute scripts in the victim’s browser when a crafted URL or input is used. The vulnerability requir...

CVE-2024-43733

CVE-2024-43733 affects Adobe Experience Manager (AEM) 6.5.21 and earlier with a DOM-based Cross-Site Scripting (XSS) flaw. The vulnerability allows injection of malicious scripts via manipulated DOM elements using crafted URLs or user input, executing in the victim’s browser context and requiring...

CVE-2024-43742

CVE-2024-43742 corresponds to a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager, affecting version 6.5.21 and earlier. The issue arises from improper input handling in vulnerable form fields, allowing attackers to inject malicious JavaScript executed in a victim’s brow...

CVE-2024-49523

Adobe Experience Manager (AEM) 6.5.20 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. An attacker can inject malicious JavaScript that may execute in a victim’s browser when visiting pages containing the affected field. The issue is document...

CVE-2024-52860

Adobe Experience Manager (AEM) v6.5.21 and earlier is affected by a DOM-based XSS vulnerability (CVE-2024-52860). The issue allows an attacker to execute arbitrary code in the victim’s browser context by manipulating a DOM element via a crafted URL or user input; exploitation requires user intera...

CVE-2025-47052

Adobe Experience Manager (AEM) 6.5.22 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The issue can be exploited by a low-privileged attacker to inject malicious JavaScript, which may execute in a victim’s browser when loading the page conta...

CVE-2025-47086

Adobe Experience Manager (AEM) exposes CVE-2025-47086: a stored Cross-Site Scripting (XSS) vulnerability in AEM 6.5.22 and earlier. A low-privilege attacker can inject malicious scripts via vulnerable form fields, with JavaScript potentially executing in the victim’s browser when loading the page...

CVE-2024-36157

CVE-2024-36157 affects Adobe Experience Manager 6.5.20 and earlier, with a stored XSS vulnerability that could inject malicious scripts into vulnerable form fields, executing in the victim’s browser. Multiple connected sources confirm this XSS issue and a patch path: Adobe APSB24-28 provides fixe...

CVE-2024-36219

CVE-2024-36219 concerns Adobe Experience Manager (AEM) versions 6.5.20 and earlier, affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The underlying issue allows an attacker to inject malicious scripts, which may execute in a user’s browser when loading the ...

CVE-2024-36235

CVE-2024-36235 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier, due to a DOM-based XSS vulnerability that can lead to arbitrary JavaScript execution in a victim’s browser when a user interacts with crafted content. Exploitation requires user interaction. The issue is addressed ...

CVE-2024-43752

CVE-2024-43752 affects Adobe Experience Manager (AEM) 6.5.21 and earlier. The vulnerability is a stored Cross-Site Scripting (XSS) in vulnerable form fields, allowing attacker-controlled JavaScript to run in a victim’s browser when visiting a page containing the vulnerable field. The published sc...

CVE-2025-47116

CVE-2025-47116 : Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker could inject malicious scripts, and malicious JavaScript may execute in a victim’s browser when visiti...

CVE-2024-26090

CVE-2024-26090 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier. The vulnerability is DOM-based XSS that could allow arbitrary JavaScript execution in the victim’s browser if a user interacts with a crafted payload (e.g., clicking a link). CVSS v3.1 base metrics indicate a MEDIU...

CVE-2024-26093

CVE-2024-26093 – Adobe Experience Manager : AEM v6.5.20 and earlier is vulnerable to a reflected XSS that can execute malicious JavaScript in a victim’s browser when a user visits a crafted URL referencing a vulnerable page. Exploitation typically requires user interaction, and the impact is in-b...

CVE-2024-26116

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a reflected Cross‑Site Scripting (XSS) vulnerability. An attacker can lure a user to a crafted URL referencing a vulnerable page, causing malicious JavaScript to execute in the victim’s browser. The issue is documented across multi...

CVE-2024-36143

CVE-2024-36143 affects Adobe Experience Manager 6.5.20 and earlier with a stored XSS in vulnerable form fields. Malicious JavaScript can execute in a victim’s browser when visiting pages containing the field. CVSS v3.1 base score 5.4 (MEDIUM); attack vector Network, user interaction Required, imp...

CVE-2024-36162

CVE-2024-36162 affects Adobe Experience Manager (AEM) 6.5.20 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser when they visit the affected page. The vulnerabil...

CVE-2024-36187

Adobe Experience Manager (AEM) prior to version 6.5.21 is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing attacker-injected JavaScript to run in the victim’s browser when visiting a page containing the field. Affected product/version: AEM 6.5.20 a...

CVE-2024-36216

Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability that can be exploited when a victim is lured to a crafted URL, allowing arbitrary JavaScript to run in the user’s browser. The issue targets the AEM web frontend and arises fr...

CVE-2024-43712

Adobe Experience Manager (AEM) versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2024-43712), where unsanitized data from a user-controllable source is used in the DOM, enabling arbitrary script execution in the victim's browser. Exploitation re...

CVE-2024-52850

CVE-2024-52850 affects Adobe Experience Manager (AEM) 6.5.21 and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability where malicious JavaScript can be injected into vulnerable form fields and executed in a victim’s browser when visiting the affected page. The primary published detail...

CVE-2025-46840

Adobe Experience Manager (AEM) up to version 6.5.22 is affected by an Improper Authorization vulnerability (CVE-2025-46840). The issue could allow a low-privileged attacker to bypass security and escalate privileges, potentially enabling session takeover. Exploitation requires user interaction, a...

CVE-2025-46954

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that could allow a low-privileged attacker to inject malicious JavaScript executed in a victim’s browser. The available connected documents identify the...

CVE-2024-20780

CVE-2024-20780 affects Adobe Experience Manager (AEM) versions 6.5.19 and earlier. A stored Cross-Site Scripting (XSS) vulnerability exists in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser when visiting a page containing the vulnerable...

CVE-2024-26049

Adobe Experience Manager 6.5.20 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. The issue can be exploited by a privileged attacker to inject malicious scripts, with the attacker needing user interaction and elevated privileges (per CVSS: H...

CVE-2024-26074

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored XSS vulnerability (CVE-2024-26074) in vulnerable form fields, allowing injected JavaScript to run in a victim’s browser. Remediation: upgrade to 6.5.21 or later (per APSB24-28). The CVSS v3.1 base score is 5.4 (Medium). If...

CVE-2024-43721

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2024-43721). An attacker can manipulate a DOM element via a crafted URL or user input to execute malicious scripts in the victim’s browser; exploitation requires user interac...

CVE-2024-43722

CVE-2024-43722 affects Adobe Experience Manager (AEM) 6.5.21 and earlier with a DOM-based XSS flaw. An attacker can inject scripts by manipulating a DOM element via a crafted URL or input, requiring user interaction, potentially executing arbitrary code in the victim’s browser. Affected product/v...

CVE-2024-49524

CVE-2024-49524 affects Adobe Experience Manager versions 6.5.20 and earlier, with a DOM-based Cross-Site Scripting (XSS) vulnerability. By manipulating a DOM element through a crafted URL or user input, an attacker can inject scripts that execute in the victim’s browser context. Exploitation typi...

CVE-2024-52849

CVE-2024-52849 pertains to Adobe Experience Manager (AEM) and is a stored Cross-Site Scripting (XSS) vulnerability affecting AEM 6.5.21 and earlier. The issue is triggered when malicious input is submitted into vulnerable form fields, allowing JavaScript to execute in a victim’s browser upon page...

CVE-2024-53966

CVE-2024-53966 concerns Adobe Experience Manager (AEM) versions 6.5.21 and earlier, affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker could inject malicious scripts, which execute in a victim’s browser when they access the affected ...

CVE-2025-47065

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious JavaScript that executes in a victim’s browser when visiting a page with the injected field (CVE-2...