Multiple vulnerabilities in Adobe Experience Manager

1) Stored cross-site scripting

EUVDB-ID: #VU110952

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47029

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stored cross-site scripting

EUVDB-ID: #VU110944

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47014

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Stored cross-site scripting

EUVDB-ID: #VU110945

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47015

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Stored cross-site scripting

EUVDB-ID: #VU110946

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47016

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Stored cross-site scripting

EUVDB-ID: #VU110947

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47017

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Stored cross-site scripting

EUVDB-ID: #VU110948

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47019

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Stored cross-site scripting

EUVDB-ID: #VU110949

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47020

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Stored cross-site scripting

EUVDB-ID: #VU110950

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47021

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) DOM-based cross-site scripting

EUVDB-ID: #VU110800

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47022

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) DOM-based cross-site scripting

EUVDB-ID: #VU110801

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47025

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Stored cross-site scripting

EUVDB-ID: #VU110951

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47026

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) DOM-based cross-site scripting

EUVDB-ID: #VU110802

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47027

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Stored cross-site scripting

EUVDB-ID: #VU110953

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47030

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Stored cross-site scripting

EUVDB-ID: #VU110942

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47012

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Stored cross-site scripting

EUVDB-ID: #VU110954

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47031

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) DOM-based cross-site scripting

EUVDB-ID: #VU110803

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47032

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) DOM-based cross-site scripting

EUVDB-ID: #VU110804

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47033

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) DOM-based cross-site scripting

EUVDB-ID: #VU110805

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47034

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) DOM-based cross-site scripting

EUVDB-ID: #VU110806

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47035

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) DOM-based cross-site scripting

EUVDB-ID: #VU110807

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47036

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) DOM-based cross-site scripting

EUVDB-ID: #VU110808

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47037

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) DOM-based cross-site scripting

EUVDB-ID: #VU110809

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47038

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) DOM-based cross-site scripting

EUVDB-ID: #VU110810

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47039

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) DOM-based cross-site scripting

EUVDB-ID: #VU110811

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47040

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) DOM-based cross-site scripting

EUVDB-ID: #VU110812

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47041

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) DOM-based cross-site scripting

EUVDB-ID: #VU110813

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47042

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Stored cross-site scripting

EUVDB-ID: #VU110943

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47013

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Stored cross-site scripting

EUVDB-ID: #VU110941

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47011

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) DOM-based cross-site scripting

EUVDB-ID: #VU110815

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47045

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Stored cross-site scripting

EUVDB-ID: #VU110927

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46990

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Stored cross-site scripting

EUVDB-ID: #VU110919

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46978

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Stored cross-site scripting

EUVDB-ID: #VU110920

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46979

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Stored cross-site scripting

EUVDB-ID: #VU110921

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46981

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Stored cross-site scripting

EUVDB-ID: #VU110922

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46982

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Stored cross-site scripting

EUVDB-ID: #VU110923

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46983

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) DOM-based cross-site scripting

EUVDB-ID: #VU110796

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46984

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Stored cross-site scripting

EUVDB-ID: #VU110924

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46985

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Stored cross-site scripting

EUVDB-ID: #VU110925

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46986

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Stored cross-site scripting

EUVDB-ID: #VU110926

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46987

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) DOM-based cross-site scripting

EUVDB-ID: #VU110797

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46988

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) DOM-based cross-site scripting

EUVDB-ID: #VU110798

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46989

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Stored cross-site scripting

EUVDB-ID: #VU110928

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46991

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Stored cross-site scripting

EUVDB-ID: #VU110940

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47010

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Stored cross-site scripting

EUVDB-ID: #VU110929

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46992

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Stored cross-site scripting

EUVDB-ID: #VU110930

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46995

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Stored cross-site scripting

EUVDB-ID: #VU110931

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46997

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Stored cross-site scripting

EUVDB-ID: #VU110932

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46999

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Stored cross-site scripting

EUVDB-ID: #VU110933

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47000

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Stored cross-site scripting

EUVDB-ID: #VU110934

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47002

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Stored cross-site scripting

EUVDB-ID: #VU110935

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47003

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Stored cross-site scripting

EUVDB-ID: #VU110936

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47004

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) DOM-based cross-site scripting

EUVDB-ID: #VU110799

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47005

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Stored cross-site scripting

EUVDB-ID: #VU110937

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47006

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Stored cross-site scripting

EUVDB-ID: #VU110938

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47007

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Stored cross-site scripting

EUVDB-ID: #VU110939

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47008

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) DOM-based cross-site scripting

EUVDB-ID: #VU110814

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47044

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) DOM-based cross-site scripting

EUVDB-ID: #VU110816

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47047

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) DOM-based cross-site scripting

EUVDB-ID: #VU110794

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46976

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Stored cross-site scripting

EUVDB-ID: #VU110987

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47100

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Stored cross-site scripting

EUVDB-ID: #VU110977

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47084

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Stored cross-site scripting

EUVDB-ID: #VU110978

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47085

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) Stored cross-site scripting

EUVDB-ID: #VU110979

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47086

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Stored cross-site scripting

EUVDB-ID: #VU110980

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47087

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Stored cross-site scripting

EUVDB-ID: #VU110981

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47088

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Stored cross-site scripting

EUVDB-ID: #VU110982

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47089

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Stored cross-site scripting

EUVDB-ID: #VU110983

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47090

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Stored cross-site scripting

EUVDB-ID: #VU110984

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47091

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Stored cross-site scripting

EUVDB-ID: #VU110985

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47092

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Stored cross-site scripting

EUVDB-ID: #VU110986

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47093

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Cross-site scripting

EUVDB-ID: #VU110830

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47094

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) DOM-based cross-site scripting

EUVDB-ID: #VU110825

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47102

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Stored cross-site scripting

EUVDB-ID: #VU110975

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47082

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Stored cross-site scripting

EUVDB-ID: #VU110988

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47113

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Stored cross-site scripting

EUVDB-ID: #VU110989

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47114

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Stored cross-site scripting

EUVDB-ID: #VU110990

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47115

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Stored cross-site scripting

EUVDB-ID: #VU110991

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47116

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) DOM-based cross-site scripting

EUVDB-ID: #VU110826

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47117

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Input validation error

EUVDB-ID: #VU110997

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-47096

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote user to bypass implemented security restrictions. 

The vulnerability exists due to insufficient validation of user-supplied input. A remote user can pass specially crafted input to the application and modify data. 

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Open redirect

EUVDB-ID: #VU110993

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47095

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Exploit availability: No

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Stored cross-site scripting

EUVDB-ID: #VU110976

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47083

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Stored cross-site scripting

EUVDB-ID: #VU110974

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47081

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) DOM-based cross-site scripting

EUVDB-ID: #VU110817

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47048

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Stored cross-site scripting

EUVDB-ID: #VU110959

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47066

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) DOM-based cross-site scripting

EUVDB-ID: #VU110818

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47049

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) DOM-based cross-site scripting

EUVDB-ID: #VU110819

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47050

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) DOM-based cross-site scripting

EUVDB-ID: #VU110820

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47051

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) DOM-based cross-site scripting

EUVDB-ID: #VU110821

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47052

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Stored cross-site scripting

EUVDB-ID: #VU110955

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47055

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) DOM-based cross-site scripting

EUVDB-ID: #VU110822

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47056

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) DOM-based cross-site scripting

EUVDB-ID: #VU110823

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47057

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Stored cross-site scripting

EUVDB-ID: #VU110956

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47060

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Stored cross-site scripting

EUVDB-ID: #VU110957

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47062

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) DOM-based cross-site scripting

EUVDB-ID: #VU110824

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47063

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Stored cross-site scripting

EUVDB-ID: #VU110958

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47065

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Stored cross-site scripting

EUVDB-ID: #VU110960

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47067

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Stored cross-site scripting

EUVDB-ID: #VU110973

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47080

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Stored cross-site scripting

EUVDB-ID: #VU110961

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47068

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Stored cross-site scripting

EUVDB-ID: #VU110962

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47069

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Stored cross-site scripting

EUVDB-ID: #VU110963

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47070

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Stored cross-site scripting

EUVDB-ID: #VU110964

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47071

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) Stored cross-site scripting

EUVDB-ID: #VU110965

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47072

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Stored cross-site scripting

EUVDB-ID: #VU110966

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47073

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Stored cross-site scripting

EUVDB-ID: #VU110967

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47074

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Stored cross-site scripting

EUVDB-ID: #VU110968

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47075

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Stored cross-site scripting

EUVDB-ID: #VU110969

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47076

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Stored cross-site scripting

EUVDB-ID: #VU110970

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47077

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Stored cross-site scripting

EUVDB-ID: #VU110971

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47078

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Stored cross-site scripting

EUVDB-ID: #VU110972

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-47079

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) DOM-based cross-site scripting

EUVDB-ID: #VU110795

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46977

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) DOM-based cross-site scripting

EUVDB-ID: #VU110793

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46975

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Improper authorization

EUVDB-ID: #VU110995

Risk: Medium

CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-46840

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to improper authorization checks. A remote authenticated user can bypass implemented security checks and escalate privileges within the application. 

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Stored cross-site scripting

EUVDB-ID: #VU110859

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46885

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Cross-site scripting

EUVDB-ID: #VU110828

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46874

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Cross-site scripting

EUVDB-ID: #VU110829

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46875

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Stored cross-site scripting

EUVDB-ID: #VU110851

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46876

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) DOM-based cross-site scripting

EUVDB-ID: #VU110779

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46877

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Stored cross-site scripting

EUVDB-ID: #VU110852

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46878

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Stored cross-site scripting

EUVDB-ID: #VU110853

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46879

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Stored cross-site scripting

EUVDB-ID: #VU110854

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46880

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Stored cross-site scripting

EUVDB-ID: #VU110855

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46881

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Stored cross-site scripting

EUVDB-ID: #VU110856

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46882

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Stored cross-site scripting

EUVDB-ID: #VU110857

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46883

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Stored cross-site scripting

EUVDB-ID: #VU110858

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46884

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

124) Stored cross-site scripting

EUVDB-ID: #VU110860

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46886

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

125) DOM-based cross-site scripting

EUVDB-ID: #VU110778

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46872

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

126) Stored cross-site scripting

EUVDB-ID: #VU110861

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46887

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

127) Stored cross-site scripting

EUVDB-ID: #VU110862

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46888

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

128) Improper access control

EUVDB-ID: #VU110994

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-46889

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

129) DOM-based cross-site scripting

EUVDB-ID: #VU110780

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46890

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

130) Stored cross-site scripting

EUVDB-ID: #VU110863

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46891

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

131) Stored cross-site scripting

EUVDB-ID: #VU110864

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46892

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

132) Stored cross-site scripting

EUVDB-ID: #VU110865

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46893

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

133) Stored cross-site scripting

EUVDB-ID: #VU110866

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46894

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

134) Stored cross-site scripting

EUVDB-ID: #VU110867

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-46895

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote user can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Install updates from vendor's website.

Adobe Experience Manager: 6.0 - 6.5.22.0

• cpe:2.3:a:adobe:adobe_experience_manager:6.0:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.0 HOTFIX 25133:*:*:*:*:*:*:*
• cpe:2.3:a:adobe:adobe_experience_manager:6.1:*:*:*:*:*:*:*

https://helpx.adobe.com/security/products/experience-manager/apsb25-48.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

135) DOM-based cross-site scripting