CVE-2025-47115

Adobe Experience Manager (AEM) 6.5.22 and earlier are affected by a stored XSS vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious scripts, which may execute in a victim’s browser when visiting a page containing the field. AEM advisory APSB25-48 and related not...

CVE-2023-22258

Adobe Experience Manager (AEM) 6.5.x up to 6.5.15.0 is affected by a URL redirection to an untrusted site (open redirect) vulnerability. A low-privilege authenticated attacker can cause a user-to-malicious-site redirect, with exploitation requiring user interaction. The issue is addressed in Adob...

CVE-2023-51462

Adobe Experience Manager 6.5.18 and earlier is affected by a reflected Cross‑Site Scripting (XSS) vulnerability. A low‑privileged attacker must entice a victim to visit a URL referencing a vulnerable page, which may cause arbitrary JavaScript to execute in the victim’s browser. CVSS v3.1 base sco...

CVE-2024-26085

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a stored XSS vulnerability (CVE-2024-26085) in vulnerable form fields. Exploitation could execute malicious JavaScript in the victim’s browser. The issue is addressed in the APSB24-28 advisory with updates for 6.5.21 and l...

CVE-2024-26088

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser. The issue stems from the DOM/storage of user-provided input ...

CVE-2024-26090

CVE-2024-26090 affects Adobe Experience Manager (AEM) versions 6.5.20 and earlier. The vulnerability is DOM-based XSS that could allow arbitrary JavaScript execution in the victim’s browser if a user interacts with a crafted payload (e.g., clicking a link). CVSS v3.1 base metrics indicate a MEDIU...

CVE-2024-26093

CVE-2024-26093 – Adobe Experience Manager : AEM v6.5.20 and earlier is vulnerable to a reflected XSS that can execute malicious JavaScript in a victim’s browser when a user visits a crafted URL referencing a vulnerable page. Exploitation typically requires user interaction, and the impact is in-b...

CVE-2024-26113

Adobe Experience Manager 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2024-26113). An attacker must entice a user to visit a vulnerable URL; this could allow malicious JavaScript to run in the victim’s browser context. Updates referenced in APSB24-2...

CVE-2024-36143

CVE-2024-36143 affects Adobe Experience Manager 6.5.20 and earlier with a stored XSS in vulnerable form fields. Malicious JavaScript can execute in a victim’s browser when visiting pages containing the field. CVSS v3.1 base score 5.4 (MEDIUM); attack vector Network, user interaction Required, imp...

CVE-2024-36169

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields, enabling attackers to inject malicious JavaScript that executes in a victim’s browser when visiting the page containing the field. Root cause: stored XSS ...

CVE-2024-36210

CVE-2024-36210 affects Adobe Experience Manager 6.5.20 and earlier and is a reflected XSS vulnerability caused by insufficient validation of input. Successful exploitation can cause malicious JavaScript to run in a victim’s browser when they visit a crafted URL referencing a vulnerable page. Publ...

CVE-2024-36216

Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability that can be exploited when a victim is lured to a crafted URL, allowing arbitrary JavaScript to run in the user’s browser. The issue targets the AEM web frontend and arises fr...

CVE-2024-36229

CVE-2024-36229 affects Adobe Experience Manager 6.5.20 and earlier and is a DOM-based XSS vulnerability that can allow an attacker to execute arbitrary JavaScript in the victim’s browser, with exploitation requiring user interaction (e.g., clicking a crafted link or submitting a form). The issue’...

CVE-2024-41849

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that can bypass a security feature and slightly affect page integrity. Exploitation requires user interaction and low privileges, with network-style exposure (per the CVE entry and related...

CVE-2024-43722

CVE-2024-43722 affects Adobe Experience Manager (AEM) 6.5.21 and earlier with a DOM-based XSS flaw. An attacker can inject scripts by manipulating a DOM element via a crafted URL or input, requiring user interaction, potentially executing arbitrary code in the victim’s browser. Affected product/v...

CVE-2024-43729

Adobe Experience Manager (AEM) 6.5.21 and earlier contains an Improper Authorization vulnerability (CVE-2024-43729) that could allow a low-privilege attacker to bypass security controls, with potential high impact to integrity and no user interaction required. Public advisories confirm the affect...

CVE-2024-52992

Adobe Experience Manager (AEM) 6.5.21 and earlier are affected by a stored XSS vulnerability (CVE-2024-52992). Malicious JavaScript in vulnerable form fields can execute in a victim’s browser when the page is loaded. CVSSv3.1 base score 5.4 (Medium) with network attack vector, low complexity, low...

CVE-2024-53966

CVE-2024-53966 concerns Adobe Experience Manager (AEM) versions 6.5.21 and earlier, affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker could inject malicious scripts, which execute in a victim’s browser when they access the affected ...

CVE-2025-47060

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The underlying issue allows a low-privileged attacker to inject malicious JavaScript, which may be executed in a victim’s browser when visiting a...

CVE-2025-47089

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability due to improper validation of user input in form fields. An attacker with low privileges could inject malicious scripts, which may execute in a victim’s browser when visiti...

CVE-2025-47093

CVE-2025-47093 affects Adobe Experience Manager versions ≤ 6.5.22, with a stored XSS vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious JavaScript, which may execute in the victim’s browser when loading the affected page. The issue is attributed to self-contai...

CVE-2025-47096

The CVE-2025-47096 entry concerns Adobe Experience Manager (AEM) versions 6.5.22 and earlier affected by an Improper Input Validation vulnerability that can bypass a security feature. Impact is described as low on integrity with no confidentiality/availability impact, and exploitation requires us...

CVE-2025-47116

CVE-2025-47116 : Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker could inject malicious scripts, and malicious JavaScript may execute in a victim’s browser when visiti...

CVE-2024-26047

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The issue could allow an attacker to inject JavaScript that executes in a victim’s browser when visiting a page containing the vulnerable field. ...

CVE-2024-26070

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing attacker-supplied JavaScript to execute in a victim’s browser when visiting the page containing the field. Connected sources confirm the produ...

CVE-2024-26114

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by CVE-2024-26114, a reflected XSS vulnerability. If a user is persuaded to visit a URL referencing a vulnerable page, attacker-supplied JavaScript can execute in the victim’s browser. The issue is described with CVSSv3.1 met...

CVE-2024-36141

CVE-2024-36141 affects Adobe Experience Manager (AEM) 6.5.20 and earlier. The described vulnerability is a stored Cross-Site Scripting (XSS) flaw in vulnerable form fields, allowing a low-privileged attacker to inject malicious scripts that may execute in a victim’s browser when visiting the affe...

CVE-2024-36150

Adobe Experience Manager is affected by a stored XSS in versions 6.5.20 and earlier, enabling malicious script injection via vulnerable form fields and execution in a user’s browser. AEM has been updated (APSB24-28) with fixes for these vulnerabilities; update to a supported version to mitigate. ...

CVE-2024-36206

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a reflected XSS vulnerability (CVE-2024-36206). An attacker must lure a user to visit a crafted URL referencing a vulnerable page, enabling malicious JavaScript to run in the victim’s browser. CVSS shows Network attack vector, Low ...

CVE-2024-36218

Adobe Experience Manager (AEM) 6.5.20 and earlier is affected by a stored XSS vulnerability in vulnerable form fields due to improper input validation. An attacker could inject malicious JavaScript that runs in a victim’s browser when visiting a page containing the vulnerable field. Remediation i...

CVE-2024-36219

CVE-2024-36219 concerns Adobe Experience Manager (AEM) versions 6.5.20 and earlier, affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The underlying issue allows an attacker to inject malicious scripts, which may execute in a user’s browser when loading the ...

CVE-2024-36221

CVE-2024-36221 concerns Adobe Experience Manager 6.5.20 and earlier, with a stored XSS in vulnerable form fields. The issue allows malicious JavaScript to execute in a victim’s browser when visiting pages containing the affected field. Public documents consistently identify the affected product/c...

CVE-2024-36225

CVE-2024-36225 affects Adobe Experience Manager versions 6.5.20 and earlier with a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. Malicious JavaScript could be executed in a victim’s browser when loading pages containing the vulnerable field. The issue is documented in...

CVE-2024-41846

Affected product/versions: Adobe Experience Manager (AEM) 6.5.20 and earlier. Vulnerability details: Stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that can inject malicious scripts; attacker-delivered JavaScript may execute in a victim’s browser when they visit a page ...

CVE-2024-41876

Adobe Experience Manager (AEM) CVE-2024-41876 affects v6.5.20 and earlier and is a reflected Cross-Site Scripting (XSS) vulnerability. Attack requires a user to visit a crafted URL referencing a vulnerable page, which can cause malicious JavaScript to execute in the victim’s browser. The issue is...

CVE-2024-43713

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based XSS vulnerability (CVE-2024-43713). The issue allows an attacker to execute arbitrary JavaScript in the victim’s browser session when a DOM element is manipulated via a crafted URL or user input, and exploitation require...

CVE-2024-43742

CVE-2024-43742 corresponds to a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager, affecting version 6.5.21 and earlier. The issue arises from improper input handling in vulnerable form fields, allowing attackers to inject malicious JavaScript executed in a victim’s brow...

CVE-2024-43755

CVE-2024-43755 affects Adobe Experience Manager 6.5.21 and earlier. Described as an Improper Input Validation vulnerability that can bypass security features and impact page integrity; exploitation requires user interaction. Adobe published APSB24-69 with updates to address multiple vulnerabiliti...

CVE-2024-52858

CVE-2024-52858 affects Adobe Experience Manager (AEM) 6.5.21 and earlier, with a stored XSS vulnerability in vulnerable form fields. An attacker can inject malicious JavaScript that executes in a victim’s browser when the page containing the vulnerable field is loaded or interacted with. Affected...

CVE-2024-52861

CVE-2024-52861 affects Adobe Experience Manager (AEM) 6.5.21 and earlier. The vulnerability is a stored Cross-Site Scripting (XSS) flaw in vulnerable form fields, allowing an attacker to inject and execute malicious JavaScript in a victim’s browser when loading a page containing the compromised f...

CVE-2025-46874

CVE-2025-46874 affects Adobe Experience Manager (AEM) 6.5.22 and earlier. The issue is a reflected Cross-Site Scripting (XSS) vulnerability where a low-privilege attacker can lure a victim to a crafted URL, causing malicious JavaScript to run in the victim’s browser. Evidence in the provided docu...

CVE-2025-46922

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are vulnerable to a stored Cross-Site Scripting (XSS) issue in vulnerable form fields. The flaw allows a low-privileged attacker to inject malicious scripts, which can execute in a victim’s browser when they visit the affected page. Root ...

CVE-2025-47088

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored XSS vulnerability in vulnerable form fields. An attacker with low privileges can inject malicious scripts that execute in a victim’s browser when visiting the affected page. Mitigation: apply the updates/patches describ...

CVE-2024-20779

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields. Root cause described in PT-2024-2857 as inadequate protection of the web page structure, allowing injected JavaScript to execute in a victim’s browser. AEM APSB24-21 pr...

CVE-2024-26075

Adobe Experience Manager (AEM) v6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields (CVE-2024-26075). The issue is documented across multiple sources (NVD/CVE references) and is associated with a MEDIUM severity (CVSS v3.1: 5.4) with user...

CVE-2024-26123

CVE-2024-26123 affects Adobe Experience Manager (AEM) 6.5.20 and earlier with a stored XSS vulnerability in form fields. The issue allows injected JavaScript to run in a victim’s browser when visiting vulnerable pages. CVSS 3.1 base score is 5.4 (Medium) with Network access, Low attack complexity...

CVE-2024-36163

Adobe Experience Manager (AEM)

CVE-2024-36164

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. The underlying issue allows an attacker to inject malicious JavaScript, which is executed in a victim’s browser when visiting a page containing the vul...

CVE-2024-36181

CVE-2024-36181 is a DOM-based XSS in Adobe Experience Manager (AEM) 6.5.20 and earlier. The issue allows an attacker to cause the victim’s browser to execute arbitrary JavaScript, with exploitation requiring user interaction (e.g., visiting a crafted page or interacting with a modified DOM elemen...

CVE-2024-36187

Adobe Experience Manager (AEM) prior to version 6.5.21 is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing attacker-injected JavaScript to run in the victim’s browser when visiting a page containing the field. Affected product/version: AEM 6.5.20 a...