Known vulnerabilities in Adobe Experience Manager Forms

Vendor: Adobe
Software CPE: cpe:2.3:a:adobe:adobe_experience_manager_forms:*:*:*:*:*:*:*:*
Total vulnerabilities: 12
Public exploits: 2
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Adobe Experience Manager Forms Adobe Experience Manager Forms is affected by 12 known vulnerabilities: 1 critical, 3 high, 3 medium, 5 low Critical High Medium Low

Vulnerabilities (12)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU113766 - Improper input validation
CVE-2025-54253
CWE-20 Critical
Available
Exploited
6.5.0-0108 07.08.2025 SB2025080774
#VU113765 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-54254
CWE-611 High
No
No
6.5.0-0108 07.08.2025 SB2025080774
#VU112848 - Deserialization of Untrusted Data
CVE-2025-49533
CWE-502 High
No
No
6.5.0.0.20250527.0 11.07.2025 SB20250711102
#VU83960 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2023-50164
CWE-22 High
Available
Exploited
6.5.19.1 07.12.2023 SB2023120703
SB2023121830
SB2024011029
and 7 more
#VU46365 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-9732
CWE-79 Medium
No
No
6.4.8.2, 6.5.6.0 08.09.2020 SB2020090805
#VU46366 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-9734
CWE-79 Medium
No
No
6.4.8.2, 6.5.6.0 08.09.2020 SB2020090805
#VU46367 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2020-9741
CWE-79 Medium
No
No
6.4.8.2, 6.5.6.0 08.09.2020 SB2020090805
#VU23535 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-8089
CWE-79 Low
No
No
6.3.3.6, 6.4.6.0, 6.5.2.0 11.12.2019 SB2019101518
#VU17118 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2018-19724
CWE-79 Low
No
No
6.2 SP1-CFP18, 6.3.3.2, 6.4.3.0 22.01.2019 SB2019012205
#VU6438 - Exposure of sensitive information to an unauthorized actor
CVE-2017-3067
CWE-200 Low
No
No
- 09.05.2017 SB2017050902
#VU1299 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-6934
CWE-79 Low
No
No
- 13.12.2016 SB2016121303
#VU1298 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2016-6933
CWE-79 Low
No
No
- 13.12.2016 SB2016121303