CVE-2024-26070

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing attacker-supplied JavaScript to execute in a victim’s browser when visiting the page containing the field. Connected sources confirm the produ...

CVE-2024-36149

Adobe Experience Manager (AEM) 6.5.20 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. An attacker could inject malicious JavaScript that runs in a victim’s browser when loading a page with the affected field. The CVE entry is supported by NV...

CVE-2024-36164

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. The underlying issue allows an attacker to inject malicious JavaScript, which is executed in a victim’s browser when visiting a page containing the vul...

CVE-2024-36181

CVE-2024-36181 is a DOM-based XSS in Adobe Experience Manager (AEM) 6.5.20 and earlier. The issue allows an attacker to cause the victim’s browser to execute arbitrary JavaScript, with exploitation requiring user interaction (e.g., visiting a crafted page or interacting with a modified DOM elemen...

CVE-2024-36218

Adobe Experience Manager (AEM) 6.5.20 and earlier is affected by a stored XSS vulnerability in vulnerable form fields due to improper input validation. An attacker could inject malicious JavaScript that runs in a victim’s browser when visiting a page containing the vulnerable field. Remediation i...

CVE-2024-41878

Affected product: Adobe Experience Manager (AEM) 6.5.19 and earlier. Vulnerability: DOM-based Cross-Site Scripting (XSS) that can allow arbitrary JavaScript execution in a user’s browser context when a user interacts with a malicious page/link. Root cause described as DOM-based XSS in AEM compone...

CVE-2024-43717

CVE-2024-43717 describes an Improper Access Control (CWE-284) vulnerability in Adobe Experience Manager, affecting versions 6.5.21 and earlier. A low-privileged attacker could bypass security protections, resulting in a low confidentiality impact, with exploitation not requiring user interaction....

CVE-2024-43721

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2024-43721). An attacker can manipulate a DOM element via a crafted URL or user input to execute malicious scripts in the victim’s browser; exploitation requires user interac...

CVE-2025-46840

Adobe Experience Manager (AEM) up to version 6.5.22 is affected by an Improper Authorization vulnerability (CVE-2025-46840). The issue could allow a low-privileged attacker to bypass security and escalate privileges, potentially enabling session takeover. Exploitation requires user interaction, a...

CVE-2025-46954

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that could allow a low-privileged attacker to inject malicious JavaScript executed in a victim’s browser. The available connected documents identify the...

CVE-2025-47021

CVE-2025-47021 affects Adobe Experience Manager before or equal to 6.5.22, with a stored XSS flaw in vulnerable form fields that can be exploited by a low‑privileged user to inject JavaScript into victims’ browsers. The issue is confirmed across multiple public feeds (including Red Hat, CNVD, NVD...

CVE-2025-47116

CVE-2025-47116 : Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker could inject malicious scripts, and malicious JavaScript may execute in a victim’s browser when visiti...

CVE-2024-26055

CVE-2024-26055 affects Adobe Experience Manager 6.5.20 and earlier with a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue could allow an attacker to run arbitrary JavaScript in the victim’s browser context, typically requiring user interaction (e.g., clicking a crafted link or submi...

CVE-2024-26088

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser. The issue stems from the DOM/storage of user-provided input ...

CVE-2024-26093

CVE-2024-26093 – Adobe Experience Manager : AEM v6.5.20 and earlier is vulnerable to a reflected XSS that can execute malicious JavaScript in a victim’s browser when a user visits a crafted URL referencing a vulnerable page. Exploitation typically requires user interaction, and the impact is in-b...

CVE-2024-36151

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2024-36151). The issue allows an attacker to execute arbitrary JavaScript in the context of a victim’s browser when a user visits a page containing a maliciously cr...

CVE-2024-41847

Summary: CVE-2024-41847 affects Adobe Experience Manager (AEM) 6.5.20 and earlier, with a reflected Cross-Site Scripting (XSS) vulnerability triggered when a user visits a vulnerable page URL. The underlying issue allows attacker-supplied JavaScript to run in the victim’s browser context. Accordi...

CVE-2024-49524

CVE-2024-49524 affects Adobe Experience Manager versions 6.5.20 and earlier, with a DOM-based Cross-Site Scripting (XSS) vulnerability. By manipulating a DOM element through a crafted URL or user input, an attacker can inject scripts that execute in the victim’s browser context. Exploitation typi...

CVE-2025-46903

Adobe Experience Manager (AEM) 6.5.22 and earlier is affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields. The issue allows a low‑privileged attacker, with user interaction, to inject JavaScript that can execute in victims’ browsers when they visit the affected ...

CVE-2025-47056

Adobe Experience Manager (AEM) 6.5.22 and earlier is affected by a stored XSS vulnerability in vulnerable form fields. The issue allows a low-privileged attacker to inject malicious JavaScript, which may execute in a victim’s browser when visiting the page containing the vulnerable field. The CVE...

CVE-2023-51462

Adobe Experience Manager 6.5.18 and earlier is affected by a reflected Cross‑Site Scripting (XSS) vulnerability. A low‑privileged attacker must entice a victim to visit a URL referencing a vulnerable page, which may cause arbitrary JavaScript to execute in the victim’s browser. CVSS v3.1 base sco...

CVE-2024-26117

CVE-2024-26117 affects Adobe Experience Manager (AEM) up to version 6.5.20 and earlier. The vulnerability is a reflected Cross-Site Scripting (XSS) that allows an attacker to induce a victim to visit a URL referencing a vulnerable page, causing malicious JavaScript to run in the victim’s browser....

CVE-2024-34142

Adobe Experience Manager CVE-2024-34142 affects versions 6.5.20 and earlier with a stored Cross-Site Scripting (XSS) flaw in vulnerable form fields. A low-privileged attacker could inject malicious scripts, which may execute in a victim’s browser when visiting pages containing the vulnerable fiel...

CVE-2024-36162

CVE-2024-36162 affects Adobe Experience Manager (AEM) 6.5.20 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing an attacker to inject malicious scripts that execute in a victim’s browser when they visit the affected page. The vulnerabil...

CVE-2024-36210

CVE-2024-36210 affects Adobe Experience Manager 6.5.20 and earlier and is a reflected XSS vulnerability caused by insufficient validation of input. Successful exploitation can cause malicious JavaScript to run in a victim’s browser when they visit a crafted URL referencing a vulnerable page. Publ...

CVE-2024-36221

CVE-2024-36221 concerns Adobe Experience Manager 6.5.20 and earlier, with a stored XSS in vulnerable form fields. The issue allows malicious JavaScript to execute in a victim’s browser when visiting pages containing the affected field. Public documents consistently identify the affected product/c...

CVE-2024-41843

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The underlying issue is improper input handling in certain pages, allowing attacker-supplied scripts to execute in a victim’s browser when the page contai...

CVE-2024-41876

Adobe Experience Manager (AEM) CVE-2024-41876 affects v6.5.20 and earlier and is a reflected Cross-Site Scripting (XSS) vulnerability. Attack requires a user to visit a crafted URL referencing a vulnerable page, which can cause malicious JavaScript to execute in the victim’s browser. The issue is...

CVE-2024-43714

Adobe Experience Manager (AEM) versions 6.5.21 and earlier are affected by a DOM-based XSS vulnerability that can execute arbitrary code in the victim’s browser when a DOM element is manipulated via crafted URL or user input; exploitation requires user interaction. Affected products: AEM 6.5.x up...

CVE-2024-43722

CVE-2024-43722 affects Adobe Experience Manager (AEM) 6.5.21 and earlier with a DOM-based XSS flaw. An attacker can inject scripts by manipulating a DOM element via a crafted URL or input, requiring user interaction, potentially executing arbitrary code in the victim’s browser. Affected product/v...

CVE-2024-52850

CVE-2024-52850 affects Adobe Experience Manager (AEM) 6.5.21 and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability where malicious JavaScript can be injected into vulnerable form fields and executed in a victim’s browser when visiting the affected page. The primary published detail...

CVE-2024-52992

Adobe Experience Manager (AEM) 6.5.21 and earlier are affected by a stored XSS vulnerability (CVE-2024-52992). Malicious JavaScript in vulnerable form fields can execute in a victim’s browser when the page is loaded. CVSSv3.1 base score 5.4 (Medium) with network attack vector, low complexity, low...

CVE-2024-52993

Adobe Experience Manager has a stored Cross-Site Scripting (XSS) vulnerability affecting versions 6.5.21 and earlier. The flaw resides in vulnerable form fields, allowing an attacker to inject malicious JavaScript that executes in a victim’s browser when visiting the affected page. Public sources...

CVE-2025-47065

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious JavaScript that executes in a victim’s browser when visiting a page with the injected field (CVE-2...

CVE-2025-47089

Adobe Experience Manager (AEM) versions 6.5.22 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability due to improper validation of user input in form fields. An attacker with low privileges could inject malicious scripts, which may execute in a victim’s browser when visiti...

CVE-2025-47115

Adobe Experience Manager (AEM) 6.5.22 and earlier are affected by a stored XSS vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious scripts, which may execute in a victim’s browser when visiting a page containing the field. AEM advisory APSB25-48 and related not...

CVE-2024-20779

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored XSS vulnerability in vulnerable form fields. Root cause described in PT-2024-2857 as inadequate protection of the web page structure, allowing injected JavaScript to execute in a victim’s browser. AEM APSB24-21 pr...

CVE-2024-26078

Adobe Experience Manager (AEM) 6.5.20 and earlier contains a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields, allowing attacker-supplied scripts to execute in a victim’s browser. The issue is explicitly tied to CVE-2024-26078 and is cited alongside related XSS CVEs in th...

CVE-2024-26113

Adobe Experience Manager 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2024-26113). An attacker must entice a user to visit a vulnerable URL; this could allow malicious JavaScript to run in the victim’s browser context. Updates referenced in APSB24-2...

CVE-2024-26114

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by CVE-2024-26114, a reflected XSS vulnerability. If a user is persuaded to visit a URL referencing a vulnerable page, attacker-supplied JavaScript can execute in the victim’s browser. The issue is described with CVSSv3.1 met...

CVE-2024-36146

Adobe Experience Manager 6.5.20 and earlier are affected by a stored XSS in vulnerable form fields. Malicious JavaScript can execute in a user’s browser when they view a page with the vulnerable field. Remediation: apply the APSB24-28 updates (AEM 6.5.21+ per advisories/patch notes).

CVE-2024-36154

Adobe Experience Manager (AEM) versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The CVE-2024-36154 entry cites improper input handling that allows injection of malicious JavaScript, which could run in a victim’s browser when ...

CVE-2024-36169

Adobe Experience Manager (AEM) 6.5.20 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields, enabling attackers to inject malicious JavaScript that executes in a victim’s browser when visiting the page containing the field. Root cause: stored XSS ...

CVE-2024-36229

CVE-2024-36229 affects Adobe Experience Manager 6.5.20 and earlier and is a DOM-based XSS vulnerability that can allow an attacker to execute arbitrary JavaScript in the victim’s browser, with exploitation requiring user interaction (e.g., clicking a crafted link or submitting a form). The issue’...

CVE-2024-43754

CVE-2024-43754 affects Adobe Experience Manager (AEM) versions 6.5.21 and earlier with a DOM-based Cross-Site Scripting (XSS) vulnerability. The issue arises when data from a malicious source is processed by client-side scripts to update the DOM, potentially allowing arbitrary code execution in t...

CVE-2024-43755

CVE-2024-43755 affects Adobe Experience Manager 6.5.21 and earlier. Described as an Improper Input Validation vulnerability that can bypass security features and impact page integrity; exploitation requires user interaction. Adobe published APSB24-69 with updates to address multiple vulnerabiliti...

CVE-2025-47075

CVE-2025-47075 corresponds to a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The issue allows a low-privileged attacker to inject malicious scripts into vulnerable form fields, which execute in a victim’s browser when visiting the ...

CVE-2025-47093

CVE-2025-47093 affects Adobe Experience Manager versions ≤ 6.5.22, with a stored XSS vulnerability in vulnerable form fields. A low-privileged attacker can inject malicious JavaScript, which may execute in the victim’s browser when loading the affected page. The issue is attributed to self-contai...

CVE-2023-22258

Adobe Experience Manager (AEM) 6.5.x up to 6.5.15.0 is affected by a URL redirection to an untrusted site (open redirect) vulnerability. A low-privilege authenticated attacker can cause a user-to-malicious-site redirect, with exploitation requiring user interaction. The issue is addressed in Adob...

CVE-2024-26047

Adobe Experience Manager (AEM) versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields. The issue could allow an attacker to inject JavaScript that executes in a victim’s browser when visiting a page containing the vulnerable field. ...