Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier - including the 6.5 LTS line and AEM Cloud Service - lets a low-privileged authenticated user persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any user who later views that page. Both preconditions from the assessed CVSS vector must hold: the attacker needs a low-privileged authenticated account with write access to the affected field (PR:L), and a victim must browse to the rendered page (UI:R), so this is not exploitable against anonymous or unauthenticated configurations. Impact is confined to low confidentiality and low integrity with a scope change (the script runs in the victim's browser context), and there is no evidence of active exploitation - no CISA KEV listing and no public exploit identified at time of analysis - with EPSS at 0.25% (15th percentile), consistent with a low-priority issue despite the wide deployment base of the product.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS line, allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when that user views the affected page. Exploitation requires a valid low-privileged AEM account (PR:L) and victim user interaction (UI:R), and impact is limited to client-side script execution with low confidentiality and integrity effects and no availability impact; CVSS is 5.4, EPSS is 0.25% (15th percentile), and no public exploit identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged user plant malicious JavaScript in vulnerable form fields, which then executes in the browser of any user who later browses to the page rendering that field. Because exploitation requires a valid account (CVSS PR:L) and victim interaction (UI:R), and the impact is confined to the victim's browser rather than the server, this is a genuine but low-priority vulnerability; no public exploit code has been identified at time of analysis and EPSS is 0.25% (15th percentile), with no evidence of active exploitation. The same weakness is reported against AEM Cloud Service and 6.5 LTS in the vendor CPE data, and Adobe documents the fix in advisory APSB25-115.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged author to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they visit the affected page. This issue also affects AEM Cloud Service and AEM 6.5 LTS, but exploitation requires a valid authoring account and victim user interaction, limiting realistic impact to insider or compromised-author scenarios. EPSS is very low (0.25%, 15th percentile), and no public exploit has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged author inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page. Because the payload is persisted and the attack requires a victim to browse to the poisoned page, exploitation depends on multi-user authoring workflows and offers limited confidentiality and integrity impact (CVSS 5.4, S:C, PR:L, UI:R). Risk is low in practice: the EPSS score is 0.25% (15th percentile), there is no evidence of active exploitation, and no public exploit code has been identified at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and the 6.5 LTS build) lets a low-privileged attacker inject malicious script that executes in a victim's browser session. Exploitation requires two conditions: a valid low-privileged account on the AEM instance (PR:L) and victim user interaction, such as visiting a crafted URL or interacting with a manipulated page (UI:R). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.25% (15th percentile), consistent with a low-priority, interaction-dependent bug.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets a low-privileged authenticated attacker execute arbitrary script in a victim's browser session when that victim visits a crafted URL or interacts with a manipulated page. Exploitation requires two independent gates: a valid low-privileged AEM account (PR:L) and successful social engineering of the victim (UI:R), and the impact stays confined to the victim's browser context with no availability loss and no server-side code execution. There is no public exploit identified at time of analysis and no evidence of active exploitation; EPSS is 0.25% (15th percentile), consistent with a genuine but low-priority issue rather than an urgent one.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including the AEM Cloud Service and 6.5 LTS builds - allows a low-privileged authenticated author to inject malicious JavaScript into form fields, which then executes in the browser of any user who browses to the affected page. Exploitation requires a valid author-level account plus a victim who visits the poisoned page, so this is a low-to-medium priority issue rather than an immediate remote-compromise risk; there is no public exploit identified at time of analysis and the EPSS score is only 0.25% (15th percentile), indicating very low predicted exploitation activity. Impact is limited to script execution in the victim's session (C:L/I:L) with no server-side code execution or availability loss.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, the 6.5 LTS line, and AEM as a Cloud Service allows a low-privileged authenticated author to persist malicious JavaScript into form fields that later executes in the browser of any user who views the affected page. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4) confirms the attack is network-reachable and low-complexity but requires a valid low-privileged account (PR:L) plus a separate victim browsing to the poisoned page (UI:R), capping impact at Low confidentiality and Low integrity with no availability effect. No public exploit has been identified at time of analysis and EPSS is only 0.22% (12th percentile), so this is assessed as a moderate, non-urgent issue rather than an emergency - prioritization should focus on restricting content-authoring permissions and applying Adobe's fix per advisory APSB25-115.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets a low-privileged authenticated attacker inject malicious script that executes in a victim's browser when the victim visits a crafted URL or interacts with a manipulated page. Impact is confined to the victim's browser context (low confidentiality and integrity, no availability or server-side code-execution impact), and exploitation requires both a valid low-privileged AEM account and victim interaction, which substantially limits realistic exposure. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and the issue is not listed in CISA KEV.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM as a Cloud Service and AEM 6.5 LTS - lets a low-privileged authenticated attacker execute arbitrary script in a victim's browser session, but only when two independent preconditions are met: the attacker holds a valid low-privilege AEM account and the victim is enticed into visiting a crafted URL or interacting with a manipulated page. The impact stays inside the victim's browser (low confidentiality and integrity, no availability loss, no server-side code execution), and the CVSS vector PR:L/UI:R confirms the authenticated, user-interaction-dependent attack path. Risk is low in practice: EPSS is 0.20% (9th percentile), the CVE is not in CISA KEV, and no public exploit has been identified at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and AEM 6.5 LTS) allows a low-privileged authenticated attacker to execute malicious scripts in a victim's browser after convincing the victim to visit a crafted URL or interact with a manipulated page. Exploitation requires both a valid low-privileged AEM account (PR:L) and victim user interaction (UI:R), confining impact to the victim's browser context with low confidentiality and integrity effects. No public exploit identified at time of analysis; EPSS is 0.20% (9th percentile), indicating low predicted exploitation likelihood. Our independent assessment rates this as a high-CVSS-name-but-modest-real-risk issue because the double gating meaningfully limits realistic exploitation.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they browse to the affected page. Exploitation requires a valid low-privileged account and a second user to view the crafted content, and the cross-context nature means the script runs in the victim's session, though with limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low at 0.20% (9th percentile), indicating a low-priority vulnerability.
Adobe Experience Manager 6.5.23 and earlier, including the 6.5 LTS build and AEM Cloud Service, is affected by stored cross-site scripting (CWE-79) in which a low-privileged, authenticated author can persist malicious JavaScript into vulnerable form fields that then executes in the browser of any user who browses the page hosting that field. Exploitation therefore requires two distinct parties: an attacker holding a valid AEM account with write access to the affected field (PR:L, so not anonymously reachable), and a separate victim who is induced or simply happens to visit the poisoned page (UI:R). Impact is confined to the victim's browser session - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N scores it 5.4 (Medium) with no server-side code execution - and no public exploit code has been identified at time of analysis, with EPSS at 0.20% (9th percentile) and no CISA KEV listing.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and AEM 6.5 LTS) allows a low-privileged, authenticated author to inject persistent JavaScript into form fields that executes in a victim's browser when that page is viewed. Per the assessed vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation requires a valid but low-privileged AEM authoring account plus a second user browsing to the poisoned page; impact is confined to client-side script execution with no server-side code execution or availability loss. No public exploit code has been identified and the flaw is not in CISA KEV; EPSS is 0.20% (9th percentile), reflecting low observed exploitation likelihood, and real-world exposure is further limited because AEM author instances are typically restricted to internal networks.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and 6.5 LTS, allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields when a victim later visits the page rendering those fields. The CVSS vector confirms network reachability but requires low-privileged write access and victim interaction, so impact is limited to the victim's browser and there is no public exploit identified at time of analysis. EPSS is 0.20% (9th percentile), and all available signals indicate a genuinely low-priority issue despite the network attack vector.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they browse to the affected page. Exploitation requires valid author-tier credentials plus victim interaction, and impact is confined to the browser context with low confidentiality and integrity effects. No public exploit was identified at time of analysis, and EPSS is 0.20% (percentile 9%).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service allows an authenticated low-privilege author to persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any user who visits the page rendering that field. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4), exploitation requires a valid author-level account and a separate victim who interacts with the poisoned page, so it is not reachable by anonymous users and cannot fire without victim interaction; impact is confined to the victim's browser session within the AEM application, with no server-side code execution or availability impact. No public exploit identified at time of analysis, and EPSS is 0.20% (9th percentile), consistent with a genuinely low-priority issue despite the network attack vector; patch available per vendor advisory (Adobe APSB25-115).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM as a Cloud Service and the 6.5 LTS line) lets a low-privileged authenticated author inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later browses the page rendering that field. Exploitation requires a valid low-privileged AEM account plus victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4), so there is no unauthenticated or fully automated attack path; assessed impact is limited confidentiality and integrity loss within the victim's session. EPSS is low at 0.20% (9th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets an authenticated low-privileged attacker inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who browses to the affected page. Exploitation is gated by two conditions - a valid low-privilege AEM account with content authoring/submission rights (PR:L) and victim interaction with the poisoned page (UI:R) - which keeps real-world risk modest despite the network attack vector. There is no public exploit identified at time of analysis and the EPSS score is only 0.20% (9th percentile), consistent with a low-priority, interaction-dependent issue.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they browse to the affected page. Exploitation requires both authoring access and victim interaction, and the EPSS score is 0.20% with no public exploit code identified at time of analysis. This is a genuine but low-priority vulnerability.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an attacker who already holds a low-privileged authenticated account inject malicious JavaScript into a form field that is persisted by the application. The script does not fire on injection but executes in the browser of a second user who later browses the page rendering the tainted field, which is why the vector requires user interaction (UI:R) on top of authentication (PR:L), with impact scoped to the victim's browser session (S:C, C:L/I:L/A:N) rather than the server. CVSS 3.1 scores it 5.4 and EPSS is only 0.20% at the 9th percentile, with no CISA KEV listing and no public exploit identified at time of analysis; this is a genuine but low-priority issue for a very high-footprint product, and the practical prerequisite of a valid low-privilege account plus a second user viewing the page keeps real-world risk modest.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets a low-privileged authenticated user inject malicious JavaScript into form fields, which then executes in the browser of any victim who later views the affected page. The flaw (CWE-79) is rated CVSS 5.4 with a scope change because the payload runs in the victim's browser session, and exploitation requires both an authenticated authoring account and a separate victim who browses to the compromised page. No public exploit code or confirmed active exploitation has been identified, and EPSS places the likelihood of exploitation in the bottom decile at 0.20% (9th percentile); consistent with this, all signals point to a genuine but low-priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets a low-privileged authenticated author persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the page rendering that field. Exploitation requires both an authenticated low-privilege AEM account capable of storing content and a victim who subsequently views the affected page, so it is not reachable pre-authentication and cannot fire without victim interaction. Scored CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), EPSS is low at 0.20% (9th percentile), and no public exploit or confirmed active exploitation was identified at time of analysis - this is a genuine but low-priority issue.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when the victim views the affected page. This affects AEM 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS. The vulnerability is low priority (EPSS 0.20%, 9th percentile) because exploitation requires an authenticated account and victim interaction; no public exploit identified at time of analysis.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) versions 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they view the affected page. Exploitation requires victim interaction and an authenticated account with content submission privileges, and the impact is confined to the browser (CVSS 5.4). No public exploit identified at time of analysis, and the vendor has released a security advisory (apsb25-115).
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious scripts into form fields, which execute in a victim's browser when they view the affected page. Exploitation requires authoring access and victim interaction, and no public exploit code or active exploitation has been identified; EPSS is low at 0.20%, making this a low-priority issue despite the 5.4 CVSS.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated author to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they browse to the affected page. Exploitation requires a valid AEM account with authoring access (PR:L) and victim interaction (UI:R), so it is not exploitable by unauthenticated attackers or without a victim visiting the page. No public exploit code or active exploitation has been identified, and EPSS is low (0.20%), making this a low-priority issue despite the medium 5.4 CVSS score.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (plus AEM Cloud Service and AEM 6.5 LTS) allows a low-privileged account - an author/contributor tier user with content submission rights - to persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who views the affected page. Rated CVSS 5.4 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the flaw is gated by two conditions: the attacker must be an authenticated provisioned author, and a victim must actively browse to the poisoned page, meaning scope change to a higher-privileged browsing session is possible but requires victim interaction. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS sits at just 0.20% (9th percentile), consistent with a genuine but low-priority issue; Adobe has published advisory APSB25-115.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated author to inject malicious JavaScript into form fields, which then executes in the browser of any user who visits the page rendering that field. Per the CVSS vector (PR:L/UI:R, scope changed), exploitation requires an existing AEM account with content-authoring rights plus victim interaction, and the resulting impact is confined to Low confidentiality and integrity loss in the victim's browser with no availability or server-side compromise. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the EPSS score of 0.20% (9th percentile) indicates a low predicted likelihood of exploitation in the near term.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious JavaScript into an affected form field, which executes in a victim's browser when that victim later browses to the page rendering the unsanitized field. Exploitation requires two conditions per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N): a valid low-privileged AEM account able to submit content into the vulnerable field, plus a victim who navigates to the poisoned page - so it is not exploitable pre-authentication and cannot fire against a passive target. Affected deployments include AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service; there is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is only 0.20% (9th percentile), consistent with a genuinely low-priority issue despite its network attack vector.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged author inject malicious JavaScript into persistent form fields, which then executes in the browser of any user who views the affected page. Exploitation requires valid authoring credentials (PR:L, so unauthenticated attackers are excluded), a writable vulnerable form field, and a separate victim's interaction with the rendered page (UI:R); these prerequisites substantially limit realistic risk despite the context-dependent CVSS base of 5.4. No public exploit code has been identified and EPSS is 0.20% (9th percentile), and this CVE is not listed in CISA KEV, so there is no evidence of active exploitation at time of analysis. Affected deployments include AEM 6.5.23 and earlier, the AEM 6.5 LTS line, and AEM as a Cloud Service.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier lets an authenticated low-privileged user - such as an author or content contributor with write access to a vulnerable form field - persist malicious JavaScript that then executes in the browser of any user who later loads the affected page. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms two prerequisites: an attacker account on the AEM instance (PR:L) and a separate victim who browses to the injected page (UI:R); because the payload is stored, no crafted link is needed and the script re-fires on each page view. Impact is limited to client-side execution within the victim's browser session (C:L/I:L, no server-side code execution and no availability impact), and with no CISA KEV listing, no public exploit code identified at time of analysis, and a low EPSS score of 0.20% (9th percentile), this is a low real-world priority despite the high-value nature of the platform.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier, including 6.5 LTS and AEM Cloud Service, allows an authenticated low-privileged attacker to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Exploitation requires valid low-privilege credentials and victim interaction, and no public exploit code or active exploitation has been identified; EPSS is 0.20% (10th percentile), indicating low predicted risk. The flaw is rated CVSS 5.4 and should be treated as a moderate-priority issue requiring prompt patching per Adobe advisory apsb25-115.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service allows an authenticated, low-privileged user to plant persistent JavaScript in vulnerable form fields that then executes in the browser of anyone who views the affected page. Because the payload is stored rather than reflected, a single low-privilege write can reach every subsequent visitor to that page, although impact stays confined to the victim's browser context with limited confidentiality and integrity effects and no availability impact (CVSS 5.4). There is no public exploit identified at time of analysis - the flaw is not in CISA KEV and EPSS is only 0.20% (10th percentile) - so real risk concentrates on deployments where semi-trusted contributors can author or edit form field content that is later rendered to other users.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service lets a low-privileged authenticated user persist malicious JavaScript into vulnerable form fields, which then executes in the browser of anyone who views the affected page. Exploitation requires an attacker to already hold an authoring or contribution account with write access to the field (PR:L - this is not remote-unauthenticated) and a victim who subsequently browses to the rendered page (UI:R), which is why the issue is scored a moderate 5.4 with impact limited to the victim's browser session (C:L/I:L, no availability impact). EPSS is just 0.20% (10th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis; this should be handled as a routine, scheduled-patch priority rather than an emergency, with the practical risk being session/token theft or action-on-behalf if a higher-privileged user views the poisoned page.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets a low-privileged authenticated author inject malicious JavaScript into vulnerable form fields, which then executes in the browser of a user who visits the affected page. Because exploitation requires a low-privileged account with write access plus a victim's interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4), and because EPSS is only 0.20% at the 10th percentile with no public exploit identified at time of analysis, this is a moderate-priority stored XSS rather than an emergency remote code execution issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated but low-privileged user persist malicious JavaScript inside AEM form fields, which then executes in the browser of a separate victim who browses to the page rendering that field. Rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the issue requires both an attacker account with write access to the affected fields and victim interaction, which meaningfully constrains real-world impact; EPSS is minimal at 0.20% (9th percentile) and no public exploit has been identified at time of analysis (not in CISA KEV). This is a genuinely moderate, not high, priority.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged user to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when the victim browses to the affected page. Exploitation requires a valid low-privileged AEM account and victim interaction, so it is not remote-unauthenticated; the scope change affects only the victim's browser session with low confidentiality and integrity impact. EPSS is 0.20% (9th percentile), no public exploit was identified at time of analysis, and the moderate CVSS score of 5.4 is consistent with a limited, interaction-dependent issue.
DOM-based cross-site scripting in Adobe Experience Manager (AEM) versions 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service allows a low-privileged authenticated attacker to execute malicious scripts in a victim's browser via a crafted URL or manipulated web page, requiring user interaction. This is a moderate-severity issue (CVSS 5.4) with an EPSS score of 0.20% (9th percentile), indicating low likelihood of exploitation; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. The vulnerability's impact is limited to script execution in the victim's browser (C:L/I:L, no availability impact), and exploitation requires both a valid low-privileged AEM account and a victim to be socially engineered into interaction, making opportunistic mass exploitation impractical.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, with the payload executing in another user's browser when they browse to the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4), and EPSS is 0.20% (9th percentile), indicating low predicted exploitation activity. No CISA KEV entry was provided, and no public exploit identified at time of analysis, making this a genuine but non-urgent moderate-severity issue.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated low-privileged user with rights to edit form fields to persist malicious JavaScript that executes in a victim's browser within the AEM origin when the victim views the affected page. Successful abuse is bounded by two prerequisites: a valid low-privileged AEM account (PR:L) and victim interaction (UI:R), so a second user must browse to the poisoned form field for the payload to fire; impact is limited to client-side script execution with low confidentiality and integrity effects and no availability impact. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is 0.20% (9th percentile), indicating low predicted exploitation likelihood in the near term, though the stored (persistent) nature of the XSS means any single successful injection can affect many downstream viewers of the page.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated user to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who browses to the page rendering that field. Exploitation is not anonymous: the CVSS vector (PR:L) requires a valid low-privileged AEM account, and success depends on a victim subsequently visiting the affected page (UI:R), limiting impact to Low confidentiality and integrity effects within the victim's browser session with no availability impact. Risk is therefore low priority - EPSS is only 0.20% (9th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets a low-privileged authenticated user inject JavaScript into vulnerable form fields, which then executes in the browser of any victim who later views the affected page. Exploitation requires two actors-an authenticated attacker who can write to the form field (PR:L per the CVSS vector) and a separate victim who browses to the rendered page (UI:R)-and the injected payload persists until the field content is cleaned. Impact is limited to the victim's browser session (C:L/I:L, A:N) rather than server-side execution; EPSS is 0.20% (9th percentile), no public exploit code or CISA KEV entry is associated with this CVE, and Adobe's advisory APSB25-115 documents the fix.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier lets an authenticated low-privileged user persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who later views the affected page. Exploitation requires two gates: an attacker account with contributor/form-authoring privileges that can submit content into the vulnerable field (CVSS PR:L), and a second user who browses to the page rendering that field (UI:R); the resulting impact is limited to Low confidentiality and Low integrity in the victim's browser via changed scope, with no server-side code execution. At the time of analysis there is no confirmed active exploitation (not in CISA KEV), no public exploit code identified, and the EPSS score is very low at 0.20% (9th percentile), making this a genuine but low-priority issue.
DOM-based cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged attacker execute malicious scripts in a victim's browser, but only if the victim visits a crafted URL or interacts with a manipulated page. The flaw is client-side only, yielding limited confidentiality and integrity impact with no availability impact. No public exploit code has been identified (EPSS 0.20%, 9th percentile), and the combined authentication and user-interaction requirements significantly limit real-world exploitation.
Concurrent token requests handled by the Auth0 Next.js SDK can be resolved through an internal in-flight request cache to the wrong result, causing an application that uses a singleton Auth0 client to receive an access token belonging to a different, simultaneously executed request - an incorrect-authorization and confidentiality exposure tracked as CWE-863. Only @auth0/nextjs-auth0 versions 4.11.0, 4.11.1, and 4.12.0 are affected; releases 4.11.2 and 4.12.1 remove the faulty TokenRequestCache. Exploitation is gated on winning a non-deterministic concurrency race (AC:H) by an authenticated user of the application (PR:L), the EPSS score is only 0.20% (9th percentile), and no public exploit has been identified at time of analysis.
User enumeration in Pega Platform can reveal whether a supplied username is valid when the deprecated basic-credentials authentication service type is enabled, affecting versions 7.1.0 through Infinity 25.1.0. The issue depends on measurable response-time differences during authentication, and the independent assessment rates it low priority because it requires the deprecated service and reliable timing discrimination; no credentials, data, or system control are obtained. Patches are available in 24.1.4, 24.2.4, and 25.1.1; EPSS is 0.44% (36th percentile) and no public exploit identified at time of analysis.
Insufficiently Protected Credentials in Adobe ColdFusion (versions 2025.4, 2023.16, and 2021.22 and earlier) enables unauthenticated remote attackers to gain limited unauthorized write access by exploiting improperly stored or transmitted credentials. The CVSS vector confirms network-accessible, zero-complexity exploitation with no privileges or user interaction required, producing limited integrity impact. Tagged as an Authentication Bypass vector, this vulnerability is distinct from a simple credential disclosure - it permits write operations, making it a meaningful integrity risk despite the moderate CVSS score. No public exploit or CISA KEV listing has been identified at time of analysis.
Memory and thread resource exhaustion in the Okta Java Management SDK 21.0.0 through 24.0.0 allows long-running, multithreaded applications to progressively degrade and eventually suffer a denial-of-service condition against themselves, because threads are not properly cleaned up after requests complete. Only applications that integrate the SDK's ApiClient in a multithreaded manner and run for extended periods under sustained load are at risk; short-lived processes, single-threaded integrations, and applications on 24.0.1 or later are unaffected. This is not an attacker-triggerable flaw but an availability defect that surfaces through the application's own normal operation, rated CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with a very low EPSS of 0.27% (17th percentile); no public exploit code or confirmed active exploitation has been identified at time of analysis, and this is a low-real-priority availability issue despite the network attack vector.