Local arbitrary code execution in MailEnable Standard editions prior to 10.54, where the MailEnable administrative executable loads MEAISO.DLL from its own installation directory without integrity validation or a hardened search order, allowing a malicious DLL dropped in that folder to run with the process's privileges. The attack is local-only and requires write access to the MailEnable installation directory plus a subsequent launch of the administrative executable; the practical limiting factor is that this directory (typically under Program Files) is normally writable only by privileged accounts, so realistic exposure is limited to hosts with misconfigured or loosened ACLs, or installations placed on world-writable paths. Per available intelligence, exploitation status is no public exploit identified at time of analysis, there is no CISA KEV listing, and EPSS is 0.17% (6th percentile), making this a genuine but lower-tier priority relative to network-reachable MailEnable flaws.
Local DLL hijacking in MailEnable versions prior to 10.54 allows an attacker who can already write to the product's installation directory to plant a malicious MEAIPO.DLL, which the administrative executable then loads on startup, running attacker-controlled code with the privileges of that process. Exploitation is local, requires existing write permission to a privileged application's install path, and only fires when the administrative executable is launched afterwards, so this is a persistence and privilege-boundary weakness (CWE-427) rather than a remote entry point; the disclosed CVSS 4.0 score is 8.5 (AV:L/AC:L/PR:L/UI:N) with a parallel CVSS 3.1 assessment of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. No public exploit code was identified at time of analysis and EPSS rates the likelihood of exploitation as low (0.17%, roughly the 6th percentile), with no CISA KEV listing indicating confirmed active exploitation.
Local arbitrary code execution in MailEnable versions prior to 10.54 is possible because the MailEnable administrative executable loads MEAIDP.DLL from its installation directory using an insecure search order and without validating the file's integrity. An attacker who already holds write access to that directory (CVSS vector PR:L, AV:L - a locally authenticated low-privileged user) can drop a malicious MEAIDP.DLL that is loaded the next time the admin tool runs, executing code at the privilege level of the launching account. The flaw is fixed in 10.54; there is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is just 0.17% (6th percentile), so real-world urgency is comparatively low despite the 8.5 vendor score.
Local arbitrary code execution in MailEnable Standard versions prior to 10.54 is possible because the administrative executable loads MEAIAU.DLL from its installation directory without sufficient integrity validation or a secure search order. An attacker with local write access to that directory (PR:L) can plant a malicious DLL that executes with the privileges of the process when the administrative tool is run, potentially by a higher-privileged user. The issue is not known to be actively exploited and no public exploit code has been identified; EPSS is low at 0.17% (5th percentile), and the risk is real but conditional on existing local write access, not an urgent, widely-exploitable priority.
Local DLL hijacking in MailEnable versions prior to 10.54 allows an attacker who already holds write access to the MailEnable installation directory to plant a malicious MEAISM.DLL that the administrative executable loads on startup, executing attacker-controlled code with the privileges of that process. Because the vector is local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and requires a pre-existing foothold with directory write permission, exploitation is not remote or unauthenticated, and the administrator must subsequently launch the admin tool as the trigger. The vulnerability is rated 8.5 under CVSS 4.0 and shows an EPSS score of just 0.17% (6th percentile), with no public exploit identified at time of analysis, indicating moderate rather than urgent real-world risk.
Local privilege escalation and code execution in MailEnable Standard prior to version 10.54, where the MailEnable administrative executable loads MEAIMF.DLL from its own installation directory without a secure search order or integrity validation (CWE-427, unsafe DLL loading). An attacker who already holds local write access to that directory can plant a malicious MEAIMF.DLL that executes with the privileges of the admin executable the next time it is started - typically by an administrator, making this a practical escalation or persistence step after an initial foothold rather than a remote entry vector. The flaw is rated CVSS 4.0 8.5 (High) by the reporter (VulnCheck), with our independent assessment at CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; EPSS is low at 0.17% (6th percentile), and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (no CISA KEV listing).
Local privilege escalation in Lenovo One Client on Windows allows an authenticated local attacker to execute code with elevated privileges via DLL hijacking (CWE-427). The attacker must write a malicious DLL to a directory searched by the application; no public exploit identified at time of analysis and EPSS is low (0.14%, 2nd percentile). The vendor rates this 8.5 (CVSS 4.0), while our independent assessment yields a CVSS 3.1 base score of 7.8 (High).
DLL hijacking in Lenovo App Store and Lenovo Browser allows a local authenticated user to execute arbitrary code with elevated privileges on Windows systems where these applications are installed. Exploitation requires the attacker to already have a low-privileged local foothold and to place a malicious DLL in a location the application searches before the legitimate library, and the vendor notes this works only 'under certain conditions'. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low at 0.14% (2nd percentile), though the flaw carries a high CVSS 4.0 base score of 8.5.
Local privilege escalation in the Lenovo Baiying Client allows an authenticated low-privilege user to execute code with elevated privileges by abusing improperly secured files, directories, or service components of the client. Only hosts running this Lenovo client - predominantly Lenovo-managed and China-market environments - are exposed, since exploitation requires an existing account on the local machine and there is no network-reachable vector. Risk is currently low in the wider ecosystem: EPSS is 0.12% (2nd percentile), no public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Okta Java SDK versions 11.0.0 through 20.0.0 allow concurrent ApiClient requests to cross-contaminate response status codes and headers, which can undermine access-control decisions in multithreaded applications. This is a timing-dependent race condition (CWE-362) that is not remotely exploitable against default deployments; exploitation requires an application that invokes ApiClient concurrently and bases authorization on its response status or headers. No public exploit or active exploitation has been identified, and EPSS is low at 0.21%, but a vendor patch is available in version 20.0.1 (GHSA text says 21.0.0+).
Local credential compromise in MailEnable versions prior to 10.54 allows an authenticated local user with read access to the AUTH.SAV file to recover plaintext passwords for all users and administrators, enabling account takeover and administrative control via POP3, SMTP, or webmail. The vulnerability stems from cleartext storage of credentials under overly permissive filesystem permissions. No public exploit code has been identified at time of analysis, and the EPSS score is low (0.12%, 2nd percentile). Exploitation requires an existing local foothold, making this a moderate, locally-scoped risk rather than an urgent remote-exploitation priority.
Cleartext storage of account credentials in MailEnable versions prior to 10.54 lets any local, authenticated user who can read the AUTH.TAB file recover every mailbox password and the super-admin credentials in plaintext, then reuse them against POP3, SMTP, or webmail for full mailbox access and administrative control. The flaw is strictly local - there is no network vector to the credential exposure itself, and exploitation depends on overly permissive default NTFS permissions on AUTH.TAB, so environments with hardened file ACLs or hosts already upgraded to 10.54+ are not exposed. No public exploit code has been identified at time of analysis and MailEnable is not listed in CISA KEV; EPSS is very low at 0.12% (2nd percentile), reflecting the requirement for pre-existing local read access rather than mass remote exploitation.
Authenticated users of i2A's CronosWeb can read personal documents belonging to other users by tampering with the 'documentCode' parameter on the '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas' endpoint. The flaw is a direct object reference (IDOR, CWE-639) affecting CronosWeb builds identified as prior to 25.00.00.12, so any organisation running an unpatched instance that is reachable by its user population is exposed to cross-user document disclosure; exploitation requires a valid account (CVSS PR:L) but no user interaction. There is no public exploit code and no confirmed active exploitation at the time of analysis, and EPSS is low at 0.34% (24th percentile), which places this as a moderate-priority confidentiality issue rather than a critical emergency.
Disk exhaustion in Apache Struts multipart request handling can allow remote unauthenticated attackers to fill server storage and disrupt service. Affected releases are Struts 2.0.0 through 6.7.4 and 7.0.0 through 7.0.3; the vendor-released fix is Struts 6.8.0 or 7.1.1. Per independent assessment, exploitation requires the application to route multipart/form-data through Struts, needs sustained request volume, and is limited to availability impact; no public exploit identified at time of analysis, and EPSS is 0.59% (47th percentile).
Neuron AI's MySQLSelectTool (versions 2.8.11 and below) is intended to be a read-only SQL interface for LLM agents, but its keyword-based validation can be bypassed so that unauthenticated remote attackers who influence tool input - typically via prompt injection through a public agent endpoint - smuggle `INTO OUTFILE`/`INTO DUMPFILE` clauses and write arbitrary files on the database server. If the MySQL/MariaDB account used by the tool holds the FILE privilege and `secure_file_priv` permits writing to a web-accessible directory, this file-write primitive can escalate to remote code execution on the application host (for example, by dropping a PHP web shell). No public exploit code has been identified at time of analysis; EPSS is low at 0.29% (19th percentile), the issue is not in CISA KEV, and the vendor has released a fix in version 2.8.12 - our assessment rates real-world risk as moderate-priority because the RCE outcome is heavily gated by server-side privileges and configuration.
Recovery codes used as a fallback for app-based (TOTP) multi-factor authentication in Filament 4.0.0 through 4.3.0 are never consumed when redeemed, so a single code keeps working indefinitely instead of once. The practical impact is that an attacker who already holds a victim's valid password plus one leaked or observed recovery code can keep satisfying the MFA challenge and log in repeatedly, effectively converting a one-time backup credential into a permanent second-factor bypass; email-based MFA and installations with recovery codes disabled are not affected. This is a conditional rather than a readily exploitable flaw: there is no public exploit identified at time of analysis, EPSS is low (~0.34%, 26th percentile), no CISA KEV listing exists, and exploitation requires the prior compromise of both credentials and a recovery code, which is why the CVSS vector carries AC:H despite a PR:N rating.
Local privilege escalation in Zoom Rooms for Windows before 6.6.0 allows an attacker with local access and low-level privileges (PR:L per CVSS vector) to bypass downgrade protection and install an older, vulnerable client build, escalating privileges. This protection mechanism failure (CWE-693) is a local, lower-urgency issue; no public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.16%.
Denial of service in Jenkins weekly releases up to and including 2.540 and LTS releases up to and including 2.528.2, where the controller fails to close HTTP-based CLI connections whose stream has become corrupted, so leaked connections and associated resources accumulate until availability degrades. The flaw is remotely triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) by any party that can reach the controller's HTTP port, and impact is confined to availability with no data disclosure or modification; no public exploit identified at time of analysis, and EPSS is low (0.56%, 45th percentile), so the practical risk is bounded primarily by network exposure of the controller.
Denial of service in the Bluetooth firmware of the JXL 9-inch Car Android Double Din Player (Android v12.0) lets an attacker within Bluetooth range crash the head unit by sending a malformed Link Manager Protocol (LMP) packet. The flaw sits in the low-level Bluetooth baseband/link layer, so no pairing or user interaction is needed to disrupt availability of the in-vehicle infotainment system. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.28%, 20th percentile), consistent with a niche automotive product rather than a mass-exploited target.
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) firmware automatically collect and transmit sensitive information over the network in cleartext, with no user disclosure or opt-in, in the devices' default operating mode. Because the data is not encrypted, anyone positioned to observe the hubs' traffic - a device on the same LAN/Wi-Fi segment or an on-path upstream device - can read the collected information; no authentication or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment; NVD rates it AV:N for 7.5). This is a privacy/data-protection weakness rather than a high-severity remote compromise: EPSS is 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
XML External Entity (XXE) injection in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier allows remote attackers to read arbitrary files from the server filesystem via maliciously crafted XML documents requiring user interaction. The vulnerability achieves scope change (CVSS S:C), meaning exploitation can affect resources beyond the vulnerable component. Adobe has released patches in APSB25-105. No confirmed active exploitation (CISA KEV) or public POC identified at time of analysis. EPSS data not available.
Reflected cross-site scripting in the HandL UTM Grabber / Tracker WordPress plugin before version 2.8.1 allows remote attackers to inject script payloads that execute in the browser of any user who opens a crafted URL, which can be leveraged to hijack an authenticated high-privilege session such as an administrator's. Exploitation is unauthenticated from the attacker's side (CVSS vector PR:N) but requires victim interaction (UI:R), since the target must be lured into clicking a link carrying the payload in the unsanitized, unescaped parameter. There is no indication of active exploitation or public exploit code at time of analysis, and the EPSS score is low at 0.17% (6th percentile); the vendor-released fix is version 2.8.1.
Reflected cross-site scripting in the HandL UTM Grabber / Tracker WordPress plugin before version 2.8.1 lets an unauthenticated attacker craft a URL that reflects an unsanitized request parameter back into the page, executing script in the browser of whoever opens it. The practical impact is limited by the UI:R interaction requirement and, more importantly, by the fact that the advisory frames the target as a high-privilege user such as an administrator - a successful hit can run JavaScript with the privileges of a logged-in admin session, and the CVSS vector reflects a scope change (S:C) with low confidentiality, integrity, and availability impact. EPSS is low at 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so this is a genuine but low-priority issue best addressed through routine plugin patching.
Privilege escalation in NomySoft Nomysem (versions through May 2025) allows remote attackers with low privileges to gain elevated rights by abusing improperly used privileged APIs. The CVSS 7.1 score reflects high attack complexity and required user interaction, and no public exploit identified at time of analysis tempers immediate risk despite the high impact ceiling.
Cross-site request forgery in 1Panel (versions 1.10.33 through 2.0.15) lets a remote attacker change the TCP port the web management service listens on by luring an authenticated administrator to a malicious webpage. Because the port-change endpoint has no anti-CSRF token or Origin/Referer checks, the victim's browser silently replays valid session cookies, moving the panel off its expected port and causing loss of access, denial of service, or unintended exposure on an attacker-chosen port. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is trivially craftable given the described missing defenses.
Account lockout denial-of-service in 1Panel (versions 1.10.33 through 2.0.15) allows a remote attacker to forcibly change an authenticated victim's username via a cross-site request forgery flaw in the Change Username endpoint at /settings/panel. Because the endpoint lacks anti-CSRF tokens and Origin/Referer validation, a victim who visits a malicious page while logged in unknowingly submits a username change with valid session cookies, after which they are logged out and locked out of their account. No public exploit identified at time of analysis; disclosed via a VulnCheck advisory with no CISA KEV listing and no EPSS data supplied.
FreePBX Endpoint Manager versions before 16.0.96 and 17.0.1 through 17.0.9 ship with a weak default app_password of only six numeric digits, which unauthenticated remote attackers can brute force to recover the credential; depending on local mapping that same password may grant access to extension, voicemail, User Manager, DPMA, or EPM phone admin functions. Severity is moderate and the impact is bounded to low confidentiality and integrity effects (CVSS v4.0 base 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N; the independent assessment confirms remote unauthenticated reach with low C/I impact and no availability impact). EPSS is 0.27% (17th percentile) and no public exploit or CISA KEV listing was identified at time of analysis. Vendor fixes are available in 16.0.96 and 17.0.10.
Arbitrary file read in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier stems from an XML External Entity (XXE) flaw (CWE-611) that lets remote unauthenticated attackers retrieve sensitive files from the server. Adobe rates the issue 8.6 (CVSS 3.1) with a scope change, and no public exploit is identified at time of analysis, though the description notes exploitation depends on conditions beyond the attacker's control.
Unauthenticated remote attackers with network reachability to the MXsecurity management REST API can register unauthorized devices by posting a crafted JSON payload to /api/v1/devices/register, exploiting a mass-assignment weakness (CWE-915) that lets the payload set object attributes the endpoint does not intend to expose. The flaw is confirmed by Moxa's PSIRT (MPSA-252631) and carries a CVSS 4.0 base score of 6.3 (Medium), with impact limited to a low integrity change and no effect on confidentiality or availability of the device or any downstream systems; authentication is not required (PR:N), though the High attack complexity (AC:H) indicates a non-trivial precondition for the crafted payload to succeed. Risk signals are consistent and unremarkable: EPSS is 0.46% (38th percentile), and no public exploit code or confirmed active exploitation has been identified at time of analysis, making this a moderate-priority hardening issue rather than an emergency response.
Improper input validation in Adobe ColdFusion (2025.4, 2023.16, 2021.22 and all earlier updates) allows an authenticated attacker holding elevated privileges on the server to write files to arbitrary filesystem locations; the compromised scope flag indicates the impact can escape the vulnerable component, making deployment of a webshell or tampering with server-side configuration a realistic escalation path toward code execution on this Java application server. Exploitation needs no user interaction and, in our independent assessment (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N), the practical gating factor is the high privilege level required rather than any exotic attack position. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS is low (0.65%, ~49th percentile), so this reads as real but privilege-gated; Adobe has published APSB25-105 with patch guidance.
Arbitrary file system read in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier results from an Improper Restriction of XML External Entity Reference (CWE-611) flaw in ColdFusion's XML parsing, which lets an attacker coerce the parser into resolving crafted external entities and disclose sensitive files from the server's file system. Exploitation is doubly gated per the CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N: the attacker must already hold high (administrative-level) privileges and a legitimate user must interact by submitting or processing attacker-influenced XML, and the scope change (S:C) means the resulting read can reach resources beyond the directly vulnerable component. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is low at 0.49% (40th percentile), and Adobe has published a fix in security bulletin APSB25-105.
Local information disclosure in Canonical's Apport crash reporting tool allows a low-privileged local attacker to read crash files that are created with incorrect group ownership, potentially exposing sensitive crash information to unintended groups. A publicly available exploit code exists, but the EPSS score is low (0.18%, 7th percentile) and no active exploitation has been confirmed. The vulnerability affects all versions of Apport per the wildcard CPE and requires an existing local account on an Ubuntu host.
Improper access control in Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier allows a local, low-privileged authenticated user - if they can persuade a legitimate user to interact with a crafted element - to bypass security checks and perform limited unauthorized writes, potentially causing denial of service. With CVSS 5.6, EPSS 0.13% (2nd percentile), no CISA KEV listing, and no public exploit identified at time of analysis, this is a genuinely low-priority issue whose realistic exploitation is constrained by the need for local access, existing credentials, and user interaction.
Local information disclosure in Zoom Rooms for macOS before version 6.6.0 allows an authenticated local user to exploit external control of a file name or path, potentially reading arbitrary files accessible to the Zoom Rooms process. The vulnerability requires an existing authenticated session on the host (PR:L) and cannot be triggered remotely or without authentication. With a CVSS base score of 5.5 and an EPSS score of 0.14%, it poses a low-priority risk; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Jenkins Coverage Plugin (2.3054.ve1ff7b_a_a_123b_ and earlier) lets an authenticated user with Item/Configure permission set a javascript:-scheme URL as the coverage results ID by submitting the job configuration through the REST API, a path that bypasses the UI validation that would otherwise reject it. The injected script then executes in the browser of any user who opens the affected job's coverage results page (CVSS 5.4, CWE-79), giving script execution limited to the victim's session (low confidentiality and integrity impact). No public exploit code has been identified at time of analysis and EPSS is low at 0.31% (22nd percentile); the practical risk is concentrated in multi-tenant or lower-trust Jenkins deployments where non-administrators are permitted to configure jobs.
Adobe Experience Manager 6.5.23 and earlier, including AEM 6.5 LTS and AEM Cloud Service, contains a DOM-based cross-site scripting flaw that lets a low-privileged authenticated attacker execute malicious script in a victim's browser when the victim visits a crafted URL or interacts with a manipulated page. Exploitation requires both a valid low-privileged AEM account (CVSS PR:L) and victim user interaction (UI:R), so it is not exploitable against anonymous visitors or default configurations without an account. EPSS is 0.27% (18th percentile), and no public exploit identified at time of analysis; consistent with our independent assessment, this is a moderate-severity, low-priority issue.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including the 6.5 LTS line and AEM Cloud Service, allows an authenticated low-privileged attacker to execute malicious scripts in a victim's browser session via a crafted URL or manipulated web page. Exploitation requires victim interaction and is confined to the victim's browser (low confidentiality/integrity impact, no availability impact), with no public exploit identified at time of analysis and a low EPSS score of 0.27% (18th percentile). This medium-severity (CVSS 5.4) flaw has multiple signals pointing to limited real-world risk despite its network attack vector.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated user to place script that executes in a victim's browser inside the AEM origin once that victim opens a crafted URL or interacts with a manipulated page. The flaw is client-side only, gated by two conditions - an authenticated low-privilege account on the AEM instance plus victim user interaction - and yields Low confidentiality and integrity impact with no availability effect, which is why the assessed real-world risk profile is genuinely low despite the network attack vector. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is only 0.27% (18th percentile), indicating very little observed exploitation pressure. Affected deployments span AEM 6.5 LTS, AEM Cloud Service, and the general 6.5 line at 6.5.23 and earlier; Adobe documents the fix in security bulletin APSB25-115.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) versions 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS, allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they view the affected page. Exploitation requires the attacker to have a valid low-privileged AEM account and the victim to interact with the compromised page, limiting real-world risk. The EPSS score is 0.25% (15th percentile) and no public exploit has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated low-privileged author to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of a victim who views the affected page. The vulnerability is rated CVSS 5.4 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and requires valid authoring/form-editing credentials plus victim interaction, so it is not exploitable by an anonymous remote attacker against a default configuration. No public exploit identified at time of analysis, and EPSS is 0.25% (15th percentile), suggesting low predicted exploitation activity.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets a low-privileged but authenticated content author plant malicious JavaScript inside vulnerable form fields; the script then executes in the browser of any user who later opens the affected page. Exploitation requires both an authoring-level account (PR:L) and a victim who browses to the poisoned page (UI:R), so it cannot be triggered pre-authentication or without user interaction, and impact is confined to the victim's browser with no server-side code execution. EPSS is very low (0.25%, 15th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, making this a low real-world-risk issue despite the recorded CVSS score of 5.4.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged user (PR:L) persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any other user who later views the page rendering that field (UI:R) - the payload is not self-triggering and requires a separate victim visit. Adobe Cloud Service and the 6.5 LTS track are also in scope, and the issue carries only limited confidentiality and integrity impact with no availability impact (CVSS 5.4), while EPSS is a low 0.25% (15th percentile) and no public exploit identified at time of analysis. Real-world priority is LOW-to-MEDIUM: exploitation presupposes legitimate author/contributor access to the AEM authoring environment plus a second user browsing the poisoned page.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and the 6.5 LTS line allows a low-privileged authenticated attacker to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Exploitation requires a valid low-privileged account with write access to a vulnerable form field and victim interaction (UI:R); EPSS is low at 0.25% (15th percentile) and no public exploit code has been identified, making real-world priority low despite the enterprise context.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated content author to inject malicious JavaScript into vulnerable form fields; the script executes in a victim's browser when that user browses to the affected page. Exploitation requires a valid low-privileged AEM account with content-authoring capability and victim interaction, so it is not unauthenticated or no-interaction exploitation. No public exploit identified at time of analysis, and EPSS is low at 0.25% (15th percentile).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM 6.5 LTS and AEM Cloud Service) lets an authenticated, low-privileged author inject malicious JavaScript into form fields, which executes in the browser of any user who later views the affected page. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4), exploitation is double-gated: the attacker must already hold a valid low-privilege AEM account with content-editing capability, and the victim must browse the poisoned page, so this is not a remote unauthenticated attack. Risk is low: no public exploit code has been identified at time of analysis, there is no CISA KEV entry, and EPSS is 0.25% (15th percentile); impact is confined to the victim's browser session with low confidentiality and integrity loss and no availability effect.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier allows an authenticated, low-privileged authoring user to inject and persist malicious JavaScript through vulnerable form fields, which then executes in the browser of any victim who browses to the page rendering that field. Exploitation is not pre-authentication: it requires a valid low-privileged AEM account with authoring access (PR:L) and a victim who subsequently visits the affected page (UI:R), and the injected script runs in the context of the victim's session, giving it scope-changing but limited confidentiality and integrity impact (S:C/C:L/I:L/A:N). EPSS is only 0.25% (15th percentile), and no public exploit code or confirmed active exploitation has been identified at time of analysis, making this a low real-world-risk issue despite the high-profile product; the practical exposure is concentrated in deployments where lower-trust authors can edit form components.
Adobe Experience Manager 6.5.23 and earlier, including the Cloud Service and 6.5 LTS tracks, can be abused by an authenticated low-privileged user to store malicious JavaScript in vulnerable form fields, which then executes in the browser of a victim who later visits the affected page and produces limited confidentiality and integrity impact in that session. Exploitation requires prior low-privilege authentication and a victim page visit, no public exploit code or CISA KEV entry was identified at time of analysis, and the EPSS score is 0.25% at the 15th percentile, making this a genuine but low-priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service allows an authenticated low-privileged author (CVSS PR:L) to persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page (UI:R). The impact is limited to the victim's browser session - no server-side code execution or availability loss is possible, and the scope change (S:C) reflects script execution in the victim's origin rather than any compromise of the AEM server. Exploitation is not pre-authentication and requires a second, interacting victim; EPSS is 0.25% (15th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, making this a low-priority, patch-driven remediation item.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets a low-privileged, authenticated attacker persist malicious JavaScript inside vulnerable form fields, which then executes in the browser of any user who later views the affected page. Exploitation requires two independent conditions - a valid low-privileged AEM account able to submit or edit content in the affected field (PR:L), plus a victim who subsequently browses to the rendering page (UI:R) - so this is a genuine-but-low-priority vulnerability with impact limited to the victim's browser session (C:L/I:L, no availability impact). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.25% (15th percentile), consistent with low predicted exploitation activity. It affects AEM 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS branch.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Exploitation requires both an authenticated account with content-editing privileges and victim interaction, limiting the attack to browser-based impacts such as session theft or page defacement rather than server compromise. No public exploit code is identified at time of analysis, and the EPSS score is 0.25% (15th percentile), indicating a low likelihood of exploitation; CISA KEV does not list this CVE.