Java
Monthly
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows authenticated remote attackers to inject malicious scripts via the index function in ServerController.java, requiring user interaction to execute. The exploit is publicly available on GitHub, though the project maintainers have not responded to early disclosure reports. With an EPSS score of 0.03% and CVSS 2.0 severity, real-world exploitation risk is minimal despite public POC availability.
Unrestricted file upload in the h-moses moga-mall Java/Spring e-commerce application lets an authenticated attacker who can reach the addProduct handler in PmsProductController.java upload files of attacker-chosen type and name by manipulating the objectName argument. Exploitation requires a valid low-privileged session (CVSS PR:L) on a remote, network-reachable deployment; it is not a pre-authentication flaw despite the 'Authentication Bypass' tag applied by the reporting source. The assessed impact is Low across confidentiality, integrity and availability (CVSS 3.1 5.3), so the issue does not inherently yield arbitrary code execution, and no public exploit identified at time of analysis - a public technical writeup of the upload path is linked in the references, but no weaponized exploit or CISA KEV entry exists for this CVE.
Stored cross-site scripting in rawchen ecms allows a high-privileged authenticated attacker to inject persistent JavaScript payloads via the productName parameter on the Add New Product page, which subsequently executes in the browsers of users who view the affected product listings. The vulnerable component is updateProductServlet.java, and the flaw stems from unsanitized input being stored and later rendered without encoding. A public proof-of-concept has been disclosed via GitHub; the vendor has not responded to the disclosure, and no patch is available.
Cross-site scripting vulnerability in SohuTV CacheCloud up to version 3.2.0 allows authenticated high-privileged remote attackers to inject arbitrary web script via the doUserList function. Exploit code is publicly available, but exploitation requires user interaction and high privileges, and the very low EPSS score (0.04%) indicates limited likelihood of widespread exploitation.
Stored cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows high-privilege authenticated users to inject malicious scripts via the doTotalList function in TotalManageController.java, which are executed in the browsers of users viewing the affected page. The vulnerability requires user interaction (UI:P) and high privileges (PR:H), limiting real-world impact despite network accessibility. Public exploit code is available, but EPSS probability remains very low (0.04%) due to the authentication and interaction requirements.
Improper authentication bypass in xiaozhi-esp32-server-java up to version 3.0.0 allows remote attackers with low-privilege access to bypass cookie-based authentication via crafted requests. A public exploit exists, but no active exploitation has been confirmed, and the exploitation probability is low (EPSS 0.10%). The vulnerability affects the tryAuthenticateWithCookies method in the AuthenticationInterceptor component.
Stored cross-site scripting (XSS) in yourmaileyes MOOC up to version 1.17 allows an authenticated attacker to inject malicious scripts via the 'review' parameter of the submission review feature, which executes when another user views the content. The vulnerability has a publicly released exploit, but no patch is available, and EPSS indicates very low exploitation probability (0.04%). This poses a low real-world risk due to limited impact and niche adoption.
Deserialization weakness in Dromara Sa-Token through version 1.44.0 allows a low-privileged authenticated remote attacker to trigger unsafe object deserialization through the SaJdkSerializer component's ObjectInputStream.readObject call, but only under a narrow set of preconditions. Exploitation requires an application that has explicitly enabled Sa-Token's JDK serialization backend and exposes a code path where attacker-controlled bytes reach readObject; per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) the impact is limited to availability with no confidentiality or integrity effect, and high attack complexity plus vendor-described difficult exploitability mean this is a low real-world risk despite the deserialization tag. No public exploit has been identified at time of analysis, the issue does not appear in CISA KEV, and the maintainers did not respond to early disclosure, so no vendor patch is confirmed.
Authenticated remote code execution affects StreamVault (StreamVault / stream-vault SpiritApplication) releases prior to 251126, where an administrator can inject arbitrary yt-dlp arguments through the /admin/api/saveConfig endpoint. The injected arguments are persisted globally and later concatenated into the yt-dlp command line assembled by YtDlpUtil.java, allowing OS command injection (CWE-78) that executes with the privileges of the StreamVault service when a download job runs. Exploitation requires a valid administrative session (CVSS PR:H), so anonymous remote attackers cannot reach it, but publicly available exploit code exists per the referenced GitHub security advisory GHSA-c747-q388-3v6m; there is no indication of confirmed active exploitation (CISA KEV), and the vulnerable argument-append feature was removed entirely in the subsequent 251226 release.
Reflected cross-site scripting (XSS) in sunkaifei FlyCMS userLogin function allows unauthenticated remote attackers to inject malicious scripts via the redirectUrl parameter, requiring user interaction to trigger. The vulnerability is publicly available for exploitation with a low CVSS score of 2.1 reflecting limited integrity impact, but active public PoC code exists and the affected project has not responded to disclosure.
Cross-site scripting (XSS) in sunkaifei FlyCMS Admin Login component allows remote attackers to inject malicious scripts via the redirectUrl parameter in IndexAdminController.java. The vulnerability requires user interaction (UI:P) and results in limited integrity impact (VI:L), with a very low CVSS score of 2.1 despite public exploit availability. Active exploitation risk is minimal given the low EPSS score (0.02%, 6th percentile) and requirement for social engineering the admin user.
Improper authorization in Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate the orderSn parameter in the submitOrderPayment function, potentially disclosing or modifying payment information for orders they do not own. The vulnerability requires valid user authentication and has publicly available exploit code; however, the EPSS score of 0.06% indicates exploitation is unlikely in practice despite the disclosed POC.
Improper access controls in Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose member information via the getMemberByMobile endpoint in MemberController.java. The vulnerability has publicly available exploit code and affects a core user management function, though the EPSS score of 0.04% suggests limited real-world exploitation despite public availability of proof-of-concept.
Improper authorization in the MemberController.deductBalance() function of Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate user balance operations without proper authorization checks, resulting in limited confidentiality impact. Public exploit code exists for this vulnerability, though the extremely low CVSS score (2.1) and EPSS percentile (15th) suggest minimal real-world exploitation risk despite public availability.
Improper access controls in the Order Payment Handler (orderService.payOrder method) of Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose sensitive information through the OrderController component. The vulnerability requires high attack complexity and authenticated access (PR:L), limiting real-world exploitation despite publicly available proof-of-concept code. EPSS exploitation probability is 0.06% (17th percentile), suggesting low practical risk despite public POC availability.
Arbitrary file read in the Takes web framework's TkFiles take (through version 2.0-SNAPSHOT) lets remote, unauthenticated attackers escape the configured file-serving base directory by inserting ../ sequences into the HTTP request path, disclosing files readable by the Java process. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication or user interaction is needed, and the impact is limited to confidentiality with no integrity or availability effect; the practical blast radius depends on how permissive the hosting process's OS-level file permissions are. Exploitation is straightforward for any internet-reachable TkFiles-backed endpoint, and publicly available exploit code exists (a detailed proof-of-concept report is linked from the NVD entry), but there is no indication of confirmed active exploitation in the wild and no CISA KEV listing.
Authenticated users on Turms IM Server v0.10.0-SNAPSHOT and earlier can exploit a broken access control flaw (CWE-284) in the handleQueryUserOnlineStatusesRequest() method to query arbitrary users' online status, device information, and login timestamps without proper authorization checks. The vulnerability requires a valid account (CVSS PR:L) and is remotely exploitable, with publicly available exploit code. The independent assessment rates it medium severity because it leaks presence metadata rather than message content or credentials.
Memory exhaustion denial of service in Turms AI-Serving (v0.10.0-SNAPSHOT and earlier) allows remote attackers to crash the service by uploading specially crafted compressed images that expand to gigabytes when loaded via OpenCV's imread() without dimension validation. The vulnerability is in the ExtendedOpenCVImage class, and publicly available exploit code exists. The risk is bounded to deployments that expose the OCR/image upload feature, and no authentication is required if that service is publicly accessible.
Improper file type validation in the Turms AI-Serving module (v0.10.0-SNAPSHOT and earlier) allows unauthenticated remote attackers to upload arbitrary files - executables, scripts, HTML documents, or web shells - to the OCR image-upload endpoint, because the OcrController's @FormData(contentType = MediaTypeConst.IMAGE) restriction validates only client-supplied Content-Type headers and file extensions rather than actual file content. Publicly available exploit code exists in the form of a published PoC report, and the issue carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N per NVD; our assessment adds a low integrity impact). The elevated outcomes sometimes attributed to this flaw - server-side code execution or stored XSS - are not guaranteed by the upload itself and only materialize if the deployment executes the upload directory or serves stored files back to users; a hardening-lacking deployment that does neither faces only arbitrary file storage.
JeecgBoot versions up to 3.9.0 allow authenticated remote attackers to manipulate user session management through the SysUserOnlineController, resulting in unauthorized session access with low availability impact. Public exploit code is available, though the CVSS score of 2.1 reflects limited real-world risk due to the requirement for authenticated access and minimal impact scope. Active exploitation has not been confirmed in CISA KEV, and the EPSS score of 0.13% indicates low probability of widespread exploitation despite public POC availability.
Authentication bypass in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate tenant ID arguments in the SysTenantController, resulting in improper authentication checks that grant unauthorized access to other tenants' data. The vulnerability has a low CVSS score of 2.1 but publicly available exploit code exists, suggesting active researcher interest despite minimal real-world impact signals (EPSS 0.32%, low severity scope). Exploitation requires prior authentication and produces only limited information disclosure within the multi-tenant architecture.
CRLF injection in Netty's io.netty.handler.codec.http.HttpRequestEncoder (netty-codec-http) allows an attacker-influenced request URI to be written verbatim into the outbound HTTP request line, enabling HTTP request smuggling against upstream/back-end servers. The flaw affects netty-codec-http versions prior to 4.1.129.Final and the 4.2.x line from 4.2.0.Alpha1 up to (but not including) 4.2.8.Final, and is unauthenticated per the CVSS vector (AV:N/PR:N/UI:N) with low confidentiality and integrity impact (CVSS 6.5). Publicly available exploit code exists, including a reproducer in the GitHub Security Advisory, and exploitation is conditional: it requires an application that uses HttpRequestEncoder (typically via HttpClientCodec) and passes unsanitized or attacker-controlled data into the request URI. There is no confirmed active exploitation (not in CISA KEV); Netty's default HTTP header validator blocks CRLF in headers but does not sanitize the URI.
SnailJob (aizuda snail-job), a Java-based distributed job scheduling platform, up to and including version 1.6.0 contains an injection flaw in QLExpressEngine.doEval, where attacker-supplied input is passed into the QLExpress expression engine without adequate neutralization (CWE-74). An attacker who is authenticated to the SnailJob console (CVSS PR:L) and can reach a feature that evaluates user-controlled QLExpress expressions - for example job workflow/decision or routing expression fields - can inject expression syntax remotely with no user interaction, achieving limited confidentiality, integrity, and availability impact as scored by the vendor (VulDB CVSS 4.0 base 5.3, Medium; independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit code has been identified at time of analysis, and the issue is fixed by upgrading to version 1.7.0-beta1 (commit 978f316c38b3d68bb74d2489b5e5f721f6675e86).
CRLF injection in code-projects Rental Management System 2.0 allows authenticated remote attackers to manipulate log entries via the Log Handler component in Transaction.java, enabling log tampering with minimal real-world impact. The vulnerability requires prior authentication (PR:L), has low integrity impact, and carries a very low EPSS score (0.07%) despite public exploit availability, suggesting exploitation is limited to specific threat scenarios.
Server-side request forgery in PowerJob up to version 5.1.2 allows authenticated remote attackers to manipulate the targetIp and targetPort arguments in the checkConnectivity function of the Network Request Handler component, enabling SSRF attacks with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite the public exploit availability, suggesting this vulnerability has seen limited active abuse.
Server-side request forgery in Yalantis uCrop 2.2.11 allows authenticated remote attackers to manipulate the downloadFile function in BitmapLoadTask.java URL handler, enabling arbitrary HTTP requests from the affected server. The vulnerability requires user authentication (PR:L) and carries limited confidentiality and integrity impact. Public exploit code exists, though the vendor has not responded to early disclosure attempts.
Okta Java SDK versions 11.0.0 through 20.0.0 allow concurrent ApiClient requests to cross-contaminate response status codes and headers, which can undermine access-control decisions in multithreaded applications. This is a timing-dependent race condition (CWE-362) that is not remotely exploitable against default deployments; exploitation requires an application that invokes ApiClient concurrently and bases authorization on its response status or headers. No public exploit or active exploitation has been identified, and EPSS is low at 0.21%, but a vendor patch is available in version 20.0.1 (GHSA text says 21.0.0+).
Remote code execution in XWiki Rendering versions prior to 16.10.10, 17.4.3, and 17.6.0-rc-1 allows any authenticated user with edit rights-including the ability to edit their own profile-to inject script macros via insufficiently escaped {{/html}} syntax. Successful exploitation enables arbitrary Groovy or Python macro execution, granting full read/write access to all wiki contents. Public exploit code is available (EPSS 1.02%, 62nd percentile), and though not confirmed actively exploited, the low privilege requirement makes immediate patching critical.
Unauthenticated remote attackers can degrade or render XWiki's REST API unavailable by requesting unbounded result sets from endpoints such as /rest/wikis/xwiki/spaces, which by default returns every space (effectively every page) in the wiki. Affected releases are 16.10.10 and below, 17.0.0-rc-1 through 17.4.3, and 17.5.0-rc-1 through 17.6.0; the impact is availability-only (CVSS 4.0 8.7, assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), scaling with wiki size and JVM memory configuration so large installations suffer the most. No public exploit code has been identified at time of analysis and EPSS is low (0.40%, 32nd percentile), but the flaw is trivially reachable without authentication on default configurations, and vendor patches are available in 16.10.11, 17.4.4 and 17.7.0-rc-1.
Reflected cross-site scripting in XWiki Platform's Flamingo Skin Resources and Web Templates lets an attacker craft a URL whose xredirect parameter is rendered unsafely into a deletion-confirmation message, executing attacker-controlled script when the victim clicks the "No" button. All instances of both packages from 6.2-milestone-1 through 16.10.9, and from 17.0.0-rc-1 through 17.4.1, are affected; the flaw no longer exists on 16.10.10, 17.4.2, or 17.5.0+. No attacker authentication is required (PR:N) but exploitation is interaction-dependent (UI:R), and while the base impact on a low-privileged victim is limited, a victim holding admin or programming rights can be leveraged to perform arbitrary actions, including remote code execution. Publicly available exploit code exists and EPSS estimates a low 0.51% probability (41st percentile), with no confirmed active exploitation in CISA KEV.
Memory and thread resource exhaustion in the Okta Java Management SDK 21.0.0 through 24.0.0 allows long-running, multithreaded applications to progressively degrade and eventually suffer a denial-of-service condition against themselves, because threads are not properly cleaned up after requests complete. Only applications that integrate the SDK's ApiClient in a multithreaded manner and run for extended periods under sustained load are at risk; short-lived processes, single-threaded integrations, and applications on 24.0.1 or later are unaffected. This is not an attacker-triggerable flaw but an availability defect that surfaces through the application's own normal operation, rated CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with a very low EPSS of 0.27% (17th percentile); no public exploit code or confirmed active exploitation has been identified at time of analysis, and this is a low-real-priority availability issue despite the network attack vector.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM as a Cloud Service and AEM 6.5 LTS - lets a low-privileged authenticated attacker execute arbitrary script in a victim's browser session, but only when two independent preconditions are met: the attacker holds a valid low-privilege AEM account and the victim is enticed into visiting a crafted URL or interacting with a manipulated page. The impact stays inside the victim's browser (low confidentiality and integrity, no availability loss, no server-side code execution), and the CVSS vector PR:L/UI:R confirms the authenticated, user-interaction-dependent attack path. Risk is low in practice: EPSS is 0.20% (9th percentile), the CVE is not in CISA KEV, and no public exploit has been identified at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and AEM 6.5 LTS) allows a low-privileged authenticated attacker to execute malicious scripts in a victim's browser after convincing the victim to visit a crafted URL or interact with a manipulated page. Exploitation requires both a valid low-privileged AEM account (PR:L) and victim user interaction (UI:R), confining impact to the victim's browser context with low confidentiality and integrity effects. No public exploit identified at time of analysis; EPSS is 0.20% (9th percentile), indicating low predicted exploitation likelihood. Our independent assessment rates this as a high-CVSS-name-but-modest-real-risk issue because the double gating meaningfully limits realistic exploitation.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they browse to the affected page. Exploitation requires a valid low-privileged account and a second user to view the crafted content, and the cross-context nature means the script runs in the victim's session, though with limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low at 0.20% (9th percentile), indicating a low-priority vulnerability.
Adobe Experience Manager 6.5.23 and earlier, including the 6.5 LTS build and AEM Cloud Service, is affected by stored cross-site scripting (CWE-79) in which a low-privileged, authenticated author can persist malicious JavaScript into vulnerable form fields that then executes in the browser of any user who browses the page hosting that field. Exploitation therefore requires two distinct parties: an attacker holding a valid AEM account with write access to the affected field (PR:L, so not anonymously reachable), and a separate victim who is induced or simply happens to visit the poisoned page (UI:R). Impact is confined to the victim's browser session - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N scores it 5.4 (Medium) with no server-side code execution - and no public exploit code has been identified at time of analysis, with EPSS at 0.20% (9th percentile) and no CISA KEV listing.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and AEM 6.5 LTS) allows a low-privileged, authenticated author to inject persistent JavaScript into form fields that executes in a victim's browser when that page is viewed. Per the assessed vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation requires a valid but low-privileged AEM authoring account plus a second user browsing to the poisoned page; impact is confined to client-side script execution with no server-side code execution or availability loss. No public exploit code has been identified and the flaw is not in CISA KEV; EPSS is 0.20% (9th percentile), reflecting low observed exploitation likelihood, and real-world exposure is further limited because AEM author instances are typically restricted to internal networks.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM as a Cloud Service and AEM 6.5 LTS - allows an attacker who already holds a high-privileged AEM account to plant malicious JavaScript in vulnerable form fields, which then executes in the browser of any user who browses to the page rendering that field. The privilege prerequisite (PR:H) and required victim interaction (UI:R) mean realistic exploitation is limited to insider abuse or a compromised author/administrator credential rather than an anonymous external attacker, and the vulnerability cannot be triggered by low-privilege or unauthenticated users. There is no public exploit code identified at time of analysis and no evidence of active exploitation; EPSS is 0.21% (roughly the 10th percentile), consistent with a low-priority, defense-in-depth issue rather than an urgent compromise vector.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and 6.5 LTS, allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields when a victim later visits the page rendering those fields. The CVSS vector confirms network reachability but requires low-privileged write access and victim interaction, so impact is limited to the victim's browser and there is no public exploit identified at time of analysis. EPSS is 0.20% (9th percentile), and all available signals indicate a genuinely low-priority issue despite the network attack vector.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they browse to the affected page. Exploitation requires valid author-tier credentials plus victim interaction, and impact is confined to the browser context with low confidentiality and integrity effects. No public exploit was identified at time of analysis, and EPSS is 0.20% (percentile 9%).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service allows an authenticated low-privilege author to persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any user who visits the page rendering that field. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4), exploitation requires a valid author-level account and a separate victim who interacts with the poisoned page, so it is not reachable by anonymous users and cannot fire without victim interaction; impact is confined to the victim's browser session within the AEM application, with no server-side code execution or availability impact. No public exploit identified at time of analysis, and EPSS is 0.20% (9th percentile), consistent with a genuinely low-priority issue despite the network attack vector; patch available per vendor advisory (Adobe APSB25-115).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM as a Cloud Service and the 6.5 LTS line) lets a low-privileged authenticated author inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later browses the page rendering that field. Exploitation requires a valid low-privileged AEM account plus victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4), so there is no unauthenticated or fully automated attack path; assessed impact is limited confidentiality and integrity loss within the victim's session. EPSS is low at 0.20% (9th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets an authenticated low-privileged attacker inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who browses to the affected page. Exploitation is gated by two conditions - a valid low-privilege AEM account with content authoring/submission rights (PR:L) and victim interaction with the poisoned page (UI:R) - which keeps real-world risk modest despite the network attack vector. There is no public exploit identified at time of analysis and the EPSS score is only 0.20% (9th percentile), consistent with a low-priority, interaction-dependent issue.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they browse to the affected page. Exploitation requires both authoring access and victim interaction, and the EPSS score is 0.20% with no public exploit code identified at time of analysis. This is a genuine but low-priority vulnerability.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an attacker who already holds a low-privileged authenticated account inject malicious JavaScript into a form field that is persisted by the application. The script does not fire on injection but executes in the browser of a second user who later browses the page rendering the tainted field, which is why the vector requires user interaction (UI:R) on top of authentication (PR:L), with impact scoped to the victim's browser session (S:C, C:L/I:L/A:N) rather than the server. CVSS 3.1 scores it 5.4 and EPSS is only 0.20% at the 9th percentile, with no CISA KEV listing and no public exploit identified at time of analysis; this is a genuine but low-priority issue for a very high-footprint product, and the practical prerequisite of a valid low-privilege account plus a second user viewing the page keeps real-world risk modest.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets a low-privileged authenticated user inject malicious JavaScript into form fields, which then executes in the browser of any victim who later views the affected page. The flaw (CWE-79) is rated CVSS 5.4 with a scope change because the payload runs in the victim's browser session, and exploitation requires both an authenticated authoring account and a separate victim who browses to the compromised page. No public exploit code or confirmed active exploitation has been identified, and EPSS places the likelihood of exploitation in the bottom decile at 0.20% (9th percentile); consistent with this, all signals point to a genuine but low-priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets a low-privileged authenticated author persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the page rendering that field. Exploitation requires both an authenticated low-privilege AEM account capable of storing content and a victim who subsequently views the affected page, so it is not reachable pre-authentication and cannot fire without victim interaction. Scored CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), EPSS is low at 0.20% (9th percentile), and no public exploit or confirmed active exploitation was identified at time of analysis - this is a genuine but low-priority issue.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when the victim views the affected page. This affects AEM 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS. The vulnerability is low priority (EPSS 0.20%, 9th percentile) because exploitation requires an authenticated account and victim interaction; no public exploit identified at time of analysis.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) versions 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they view the affected page. Exploitation requires victim interaction and an authenticated account with content submission privileges, and the impact is confined to the browser (CVSS 5.4). No public exploit identified at time of analysis, and the vendor has released a security advisory (apsb25-115).
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious scripts into form fields, which execute in a victim's browser when they view the affected page. Exploitation requires authoring access and victim interaction, and no public exploit code or active exploitation has been identified; EPSS is low at 0.20%, making this a low-priority issue despite the 5.4 CVSS.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated author to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they browse to the affected page. Exploitation requires a valid AEM account with authoring access (PR:L) and victim interaction (UI:R), so it is not exploitable by unauthenticated attackers or without a victim visiting the page. No public exploit code or active exploitation has been identified, and EPSS is low (0.20%), making this a low-priority issue despite the medium 5.4 CVSS score.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (plus AEM Cloud Service and AEM 6.5 LTS) allows a low-privileged account - an author/contributor tier user with content submission rights - to persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who views the affected page. Rated CVSS 5.4 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the flaw is gated by two conditions: the attacker must be an authenticated provisioned author, and a victim must actively browse to the poisoned page, meaning scope change to a higher-privileged browsing session is possible but requires victim interaction. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS sits at just 0.20% (9th percentile), consistent with a genuine but low-priority issue; Adobe has published advisory APSB25-115.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated author to inject malicious JavaScript into form fields, which then executes in the browser of any user who visits the page rendering that field. Per the CVSS vector (PR:L/UI:R, scope changed), exploitation requires an existing AEM account with content-authoring rights plus victim interaction, and the resulting impact is confined to Low confidentiality and integrity loss in the victim's browser with no availability or server-side compromise. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the EPSS score of 0.20% (9th percentile) indicates a low predicted likelihood of exploitation in the near term.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious JavaScript into an affected form field, which executes in a victim's browser when that victim later browses to the page rendering the unsanitized field. Exploitation requires two conditions per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N): a valid low-privileged AEM account able to submit content into the vulnerable field, plus a victim who navigates to the poisoned page - so it is not exploitable pre-authentication and cannot fire against a passive target. Affected deployments include AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service; there is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is only 0.20% (9th percentile), consistent with a genuinely low-priority issue despite its network attack vector.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) versions 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS, allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they view the affected page. Exploitation requires the attacker to have a valid low-privileged AEM account and the victim to interact with the compromised page, limiting real-world risk. The EPSS score is 0.25% (15th percentile) and no public exploit has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated low-privileged author to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of a victim who views the affected page. The vulnerability is rated CVSS 5.4 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and requires valid authoring/form-editing credentials plus victim interaction, so it is not exploitable by an anonymous remote attacker against a default configuration. No public exploit identified at time of analysis, and EPSS is 0.25% (15th percentile), suggesting low predicted exploitation activity.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets a low-privileged but authenticated content author plant malicious JavaScript inside vulnerable form fields; the script then executes in the browser of any user who later opens the affected page. Exploitation requires both an authoring-level account (PR:L) and a victim who browses to the poisoned page (UI:R), so it cannot be triggered pre-authentication or without user interaction, and impact is confined to the victim's browser with no server-side code execution. EPSS is very low (0.25%, 15th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, making this a low real-world-risk issue despite the recorded CVSS score of 5.4.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged user (PR:L) persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any other user who later views the page rendering that field (UI:R) - the payload is not self-triggering and requires a separate victim visit. Adobe Cloud Service and the 6.5 LTS track are also in scope, and the issue carries only limited confidentiality and integrity impact with no availability impact (CVSS 5.4), while EPSS is a low 0.25% (15th percentile) and no public exploit identified at time of analysis. Real-world priority is LOW-to-MEDIUM: exploitation presupposes legitimate author/contributor access to the AEM authoring environment plus a second user browsing the poisoned page.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and the 6.5 LTS line allows a low-privileged authenticated attacker to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Exploitation requires a valid low-privileged account with write access to a vulnerable form field and victim interaction (UI:R); EPSS is low at 0.25% (15th percentile) and no public exploit code has been identified, making real-world priority low despite the enterprise context.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated content author to inject malicious JavaScript into vulnerable form fields; the script executes in a victim's browser when that user browses to the affected page. Exploitation requires a valid low-privileged AEM account with content-authoring capability and victim interaction, so it is not unauthenticated or no-interaction exploitation. No public exploit identified at time of analysis, and EPSS is low at 0.25% (15th percentile).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged author inject malicious JavaScript into persistent form fields, which then executes in the browser of any user who views the affected page. Exploitation requires valid authoring credentials (PR:L, so unauthenticated attackers are excluded), a writable vulnerable form field, and a separate victim's interaction with the rendered page (UI:R); these prerequisites substantially limit realistic risk despite the context-dependent CVSS base of 5.4. No public exploit code has been identified and EPSS is 0.20% (9th percentile), and this CVE is not listed in CISA KEV, so there is no evidence of active exploitation at time of analysis. Affected deployments include AEM 6.5.23 and earlier, the AEM 6.5 LTS line, and AEM as a Cloud Service.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM 6.5 LTS and AEM Cloud Service) lets an authenticated, low-privileged author inject malicious JavaScript into form fields, which executes in the browser of any user who later views the affected page. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4), exploitation is double-gated: the attacker must already hold a valid low-privilege AEM account with content-editing capability, and the victim must browse the poisoned page, so this is not a remote unauthenticated attack. Risk is low: no public exploit code has been identified at time of analysis, there is no CISA KEV entry, and EPSS is 0.25% (15th percentile); impact is confined to the victim's browser session with low confidentiality and integrity loss and no availability effect.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier allows an authenticated, low-privileged authoring user to inject and persist malicious JavaScript through vulnerable form fields, which then executes in the browser of any victim who browses to the page rendering that field. Exploitation is not pre-authentication: it requires a valid low-privileged AEM account with authoring access (PR:L) and a victim who subsequently visits the affected page (UI:R), and the injected script runs in the context of the victim's session, giving it scope-changing but limited confidentiality and integrity impact (S:C/C:L/I:L/A:N). EPSS is only 0.25% (15th percentile), and no public exploit code or confirmed active exploitation has been identified at time of analysis, making this a low real-world-risk issue despite the high-profile product; the practical exposure is concentrated in deployments where lower-trust authors can edit form components.
Adobe Experience Manager 6.5.23 and earlier, including the Cloud Service and 6.5 LTS tracks, can be abused by an authenticated low-privileged user to store malicious JavaScript in vulnerable form fields, which then executes in the browser of a victim who later visits the affected page and produces limited confidentiality and integrity impact in that session. Exploitation requires prior low-privilege authentication and a victim page visit, no public exploit code or CISA KEV entry was identified at time of analysis, and the EPSS score is 0.25% at the 15th percentile, making this a genuine but low-priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service allows an authenticated low-privileged author (CVSS PR:L) to persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page (UI:R). The impact is limited to the victim's browser session - no server-side code execution or availability loss is possible, and the scope change (S:C) reflects script execution in the victim's origin rather than any compromise of the AEM server. Exploitation is not pre-authentication and requires a second, interacting victim; EPSS is 0.25% (15th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, making this a low-priority, patch-driven remediation item.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets a low-privileged, authenticated attacker persist malicious JavaScript inside vulnerable form fields, which then executes in the browser of any user who later views the affected page. Exploitation requires two independent conditions - a valid low-privileged AEM account able to submit or edit content in the affected field (PR:L), plus a victim who subsequently browses to the rendering page (UI:R) - so this is a genuine-but-low-priority vulnerability with impact limited to the victim's browser session (C:L/I:L, no availability impact). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.25% (15th percentile), consistent with low predicted exploitation activity. It affects AEM 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS branch.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Exploitation requires both an authenticated account with content-editing privileges and victim interaction, limiting the attack to browser-based impacts such as session theft or page defacement rather than server compromise. No public exploit code is identified at time of analysis, and the EPSS score is 0.25% (15th percentile), indicating a low likelihood of exploitation; CISA KEV does not list this CVE.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier lets an authenticated low-privileged user - such as an author or content contributor with write access to a vulnerable form field - persist malicious JavaScript that then executes in the browser of any user who later loads the affected page. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms two prerequisites: an attacker account on the AEM instance (PR:L) and a separate victim who browses to the injected page (UI:R); because the payload is stored, no crafted link is needed and the script re-fires on each page view. Impact is limited to client-side execution within the victim's browser session (C:L/I:L, no server-side code execution and no availability impact), and with no CISA KEV listing, no public exploit code identified at time of analysis, and a low EPSS score of 0.20% (9th percentile), this is a low real-world priority despite the high-value nature of the platform.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated user to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who browses to the page rendering that content. Exploitation is a two-step chain requiring both a low-privileged account permitted to submit or edit content in the affected form field (PR:L) and a victim who views the resulting page (UI:R), so impact is confined to client-side script execution in the victim's session with no server-side code execution. This is a genuine but low-priority vulnerability: EPSS is only 0.25% (15th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, and the score is CVSS 5.4 with scope change but only low confidentiality and integrity impact.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious JavaScript into form fields, which then executes in the browser of a victim who visits the affected page. The attack requires a valid low-privileged account to persist the payload and a victim to interact with the crafted content, as reflected by the CVSS vector PR:L/UI:R. No public exploit identified at time of analysis, and the EPSS score is 0.25% (15th percentile), consistent with a genuine but low-priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM Cloud Service and the AEM 6.5 LTS branch - lets an attacker who already holds a low-privileged authenticated account inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who views the page rendering that field. Exploitation requires two conditions to line up: a valid low-privilege AEM login capable of writing to the affected field (PR:L), and a victim navigating to the poisoned page (UI:R), so there is no unauthenticated or zero-interaction path. Scoring is CVSS 5.4 with EPSS at 0.25% (15th percentile), and no public exploit identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated, low-privileged user to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any other user who views the affected page. Successful exploitation requires an account on the AEM instance (CVSS PR:L) plus victim interaction (UI:R), and the scope change in the CVSS vector (S:C) reflects that the injected script runs in the victim's browser context rather than the vulnerable component's own security context. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is very low at 0.25% (15th percentile), making this a genuinely low-priority finding despite the network attack vector.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) 6.5.23 and earlier allows an authenticated attacker with low-privilege content-authoring access to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Exploitation requires the victim to interact with the crafted page (UI:R) and the attacker to have a valid low-privileged account (PR:L), so it is not unauthenticated or remote-exploitable without credentials. No public exploit code has been identified at time of analysis, and EPSS is low at 0.25%, making this a genuine but low-priority issue for most deployments.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page. Exploitation requires two independent gates as assessed: a valid low-privileged AEM account able to submit content into the vulnerable field (PR:L per the CVSS vector), and a separate victim who must browse to the page rendering that stored payload (UI:R), which substantially limits realistic risk despite the network attack vector. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.25% (15th percentile), so this is best treated as a persistent-but-conditional content-injection issue rather than an urgent, remotely exploitable flaw.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and the 6.5 LTS track) lets a low-privileged authoring user persist malicious JavaScript into form fields, which then executes in the browser of any user who later views the affected page. Exploitation is not remote and unauthenticated: per the CVSS vector PR:L the attacker must already hold an authenticated AEM account able to submit content into the vulnerable fields, and per UI:R a separate victim must browse to the page rendering that stored content, with impact confined to limited confidentiality and integrity loss in the victim's session (scope change S:C, no availability impact). Risk is low in practice - EPSS is 0.25% (15th percentile), the issue is not in CISA KEV, and no public exploit code was identified at time of analysis - although Adobe tracked it under its APSB25-115 security bulletin, so patched builds are available from the vendor.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets an attacker with a valid low-privileged account persist malicious JavaScript inside vulnerable form fields; the script then executes in the browser of any higher-privileged user who views the affected page. The author-input prerequisite (PR:L) and the requirement that a victim navigate to the poisoned page (UI:R) substantially limit practical impact, no server-side code execution or availability loss is possible, and no public exploit has been identified at time of analysis. EPSS is 0.25% (15th percentile), consistent with a low-likelihood, targeted-abuse scenario rather than mass exploitation.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and AEM 6.5 LTS) lets a low-privileged authenticated user persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any victim who later views that page. The CVSS vector (PR:L/UI:R/S:C) confirms that the attacker must already hold a valid account with rights to submit or edit the affected form field, and that the payload only fires when a victim browses to the poisoned page - the injected script crosses into the victim's authenticated session (S:C) but yields only limited confidentiality and integrity impact (C:L/I:L) with no server-side code execution or availability loss. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.25% (15th percentile), consistent with our assessment that this is a genuinely low-priority issue despite its network attack vector.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they visit the page containing the field. The vulnerability requires a valid low-privileged authoring account and a separate victim user to interact with the page, limiting its real-world impact; no public exploit has been identified at the time of analysis and the EPSS score is 0.25% (15th percentile).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS, allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields; the script executes in a victim’s browser when that user browses to the page containing the injected field. Exploitation requires both a low-privileged AEM account (PR:L) and victim interaction (UI:R), and no public exploit has been identified at time of analysis. EPSS is 0.25% (15th percentile), consistent with a low-priority issue despite the network attack vector.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier - including the 6.5 LTS line and AEM Cloud Service - lets a low-privileged authenticated user persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any user who later views that page. Both preconditions from the assessed CVSS vector must hold: the attacker needs a low-privileged authenticated account with write access to the affected field (PR:L), and a victim must browse to the rendered page (UI:R), so this is not exploitable against anonymous or unauthenticated configurations. Impact is confined to low confidentiality and low integrity with a scope change (the script runs in the victim's browser context), and there is no evidence of active exploitation - no CISA KEV listing and no public exploit identified at time of analysis - with EPSS at 0.25% (15th percentile), consistent with a low-priority issue despite the wide deployment base of the product.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS line, allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when that user views the affected page. Exploitation requires a valid low-privileged AEM account (PR:L) and victim user interaction (UI:R), and impact is limited to client-side script execution with low confidentiality and integrity effects and no availability impact; CVSS is 5.4, EPSS is 0.25% (15th percentile), and no public exploit identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged user plant malicious JavaScript in vulnerable form fields, which then executes in the browser of any user who later browses to the page rendering that field. Because exploitation requires a valid account (CVSS PR:L) and victim interaction (UI:R), and the impact is confined to the victim's browser rather than the server, this is a genuine but low-priority vulnerability; no public exploit code has been identified at time of analysis and EPSS is 0.25% (15th percentile), with no evidence of active exploitation. The same weakness is reported against AEM Cloud Service and 6.5 LTS in the vendor CPE data, and Adobe documents the fix in advisory APSB25-115.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged author to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they visit the affected page. This issue also affects AEM Cloud Service and AEM 6.5 LTS, but exploitation requires a valid authoring account and victim user interaction, limiting realistic impact to insider or compromised-author scenarios. EPSS is very low (0.25%, 15th percentile), and no public exploit has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated low-privileged user with rights to edit form fields to persist malicious JavaScript that executes in a victim's browser within the AEM origin when the victim views the affected page. Successful abuse is bounded by two prerequisites: a valid low-privileged AEM account (PR:L) and victim interaction (UI:R), so a second user must browse to the poisoned form field for the payload to fire; impact is limited to client-side script execution with low confidentiality and integrity effects and no availability impact. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is 0.20% (9th percentile), indicating low predicted exploitation likelihood in the near term, though the stored (persistent) nature of the XSS means any single successful injection can affect many downstream viewers of the page.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated user to place script that executes in a victim's browser inside the AEM origin once that victim opens a crafted URL or interacts with a manipulated page. The flaw is client-side only, gated by two conditions - an authenticated low-privilege account on the AEM instance plus victim user interaction - and yields Low confidentiality and integrity impact with no availability effect, which is why the assessed real-world risk profile is genuinely low despite the network attack vector. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is only 0.27% (18th percentile), indicating very little observed exploitation pressure. Affected deployments span AEM 6.5 LTS, AEM Cloud Service, and the general 6.5 line at 6.5.23 and earlier; Adobe documents the fix in security bulletin APSB25-115.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets a low-privileged authenticated attacker inject malicious script that executes in a victim's browser when the victim visits a crafted URL or interacts with a manipulated page. Impact is confined to the victim's browser context (low confidentiality and integrity, no availability or server-side code-execution impact), and exploitation requires both a valid low-privileged AEM account and victim interaction, which substantially limits realistic exposure. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and the issue is not listed in CISA KEV.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged author inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page. Because the payload is persisted and the attack requires a victim to browse to the poisoned page, exploitation depends on multi-user authoring workflows and offers limited confidentiality and integrity impact (CVSS 5.4, S:C, PR:L, UI:R). Risk is low in practice: the EPSS score is 0.25% (15th percentile), there is no evidence of active exploitation, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated user to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who browses to the page rendering that field. Exploitation is not anonymous: the CVSS vector (PR:L) requires a valid low-privileged AEM account, and success depends on a victim subsequently visiting the affected page (UI:R), limiting impact to Low confidentiality and integrity effects within the victim's browser session with no availability impact. Risk is therefore low priority - EPSS is only 0.20% (9th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets a low-privileged authenticated user inject JavaScript into vulnerable form fields, which then executes in the browser of any victim who later views the affected page. Exploitation requires two actors-an authenticated attacker who can write to the form field (PR:L per the CVSS vector) and a separate victim who browses to the rendered page (UI:R)-and the injected payload persists until the field content is cleaned. Impact is limited to the victim's browser session (C:L/I:L, A:N) rather than server-side execution; EPSS is 0.20% (9th percentile), no public exploit code or CISA KEV entry is associated with this CVE, and Adobe's advisory APSB25-115 documents the fix.
DOM-based cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged attacker execute malicious scripts in a victim's browser, but only if the victim visits a crafted URL or interacts with a manipulated page. The flaw is client-side only, yielding limited confidentiality and integrity impact with no availability impact. No public exploit code has been identified (EPSS 0.20%, 9th percentile), and the combined authentication and user-interaction requirements significantly limit real-world exploitation.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and the 6.5 LTS build) lets a low-privileged attacker inject malicious script that executes in a victim's browser session. Exploitation requires two conditions: a valid low-privileged account on the AEM instance (PR:L) and victim user interaction, such as visiting a crafted URL or interacting with a manipulated page (UI:R). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.25% (15th percentile), consistent with a low-priority, interaction-dependent bug.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows authenticated remote attackers to inject malicious scripts via the index function in ServerController.java, requiring user interaction to execute. The exploit is publicly available on GitHub, though the project maintainers have not responded to early disclosure reports. With an EPSS score of 0.03% and CVSS 2.0 severity, real-world exploitation risk is minimal despite public POC availability.
Unrestricted file upload in the h-moses moga-mall Java/Spring e-commerce application lets an authenticated attacker who can reach the addProduct handler in PmsProductController.java upload files of attacker-chosen type and name by manipulating the objectName argument. Exploitation requires a valid low-privileged session (CVSS PR:L) on a remote, network-reachable deployment; it is not a pre-authentication flaw despite the 'Authentication Bypass' tag applied by the reporting source. The assessed impact is Low across confidentiality, integrity and availability (CVSS 3.1 5.3), so the issue does not inherently yield arbitrary code execution, and no public exploit identified at time of analysis - a public technical writeup of the upload path is linked in the references, but no weaponized exploit or CISA KEV entry exists for this CVE.
Stored cross-site scripting in rawchen ecms allows a high-privileged authenticated attacker to inject persistent JavaScript payloads via the productName parameter on the Add New Product page, which subsequently executes in the browsers of users who view the affected product listings. The vulnerable component is updateProductServlet.java, and the flaw stems from unsanitized input being stored and later rendered without encoding. A public proof-of-concept has been disclosed via GitHub; the vendor has not responded to the disclosure, and no patch is available.
Cross-site scripting vulnerability in SohuTV CacheCloud up to version 3.2.0 allows authenticated high-privileged remote attackers to inject arbitrary web script via the doUserList function. Exploit code is publicly available, but exploitation requires user interaction and high privileges, and the very low EPSS score (0.04%) indicates limited likelihood of widespread exploitation.
Stored cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows high-privilege authenticated users to inject malicious scripts via the doTotalList function in TotalManageController.java, which are executed in the browsers of users viewing the affected page. The vulnerability requires user interaction (UI:P) and high privileges (PR:H), limiting real-world impact despite network accessibility. Public exploit code is available, but EPSS probability remains very low (0.04%) due to the authentication and interaction requirements.
Improper authentication bypass in xiaozhi-esp32-server-java up to version 3.0.0 allows remote attackers with low-privilege access to bypass cookie-based authentication via crafted requests. A public exploit exists, but no active exploitation has been confirmed, and the exploitation probability is low (EPSS 0.10%). The vulnerability affects the tryAuthenticateWithCookies method in the AuthenticationInterceptor component.
Stored cross-site scripting (XSS) in yourmaileyes MOOC up to version 1.17 allows an authenticated attacker to inject malicious scripts via the 'review' parameter of the submission review feature, which executes when another user views the content. The vulnerability has a publicly released exploit, but no patch is available, and EPSS indicates very low exploitation probability (0.04%). This poses a low real-world risk due to limited impact and niche adoption.
Deserialization weakness in Dromara Sa-Token through version 1.44.0 allows a low-privileged authenticated remote attacker to trigger unsafe object deserialization through the SaJdkSerializer component's ObjectInputStream.readObject call, but only under a narrow set of preconditions. Exploitation requires an application that has explicitly enabled Sa-Token's JDK serialization backend and exposes a code path where attacker-controlled bytes reach readObject; per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) the impact is limited to availability with no confidentiality or integrity effect, and high attack complexity plus vendor-described difficult exploitability mean this is a low real-world risk despite the deserialization tag. No public exploit has been identified at time of analysis, the issue does not appear in CISA KEV, and the maintainers did not respond to early disclosure, so no vendor patch is confirmed.
Authenticated remote code execution affects StreamVault (StreamVault / stream-vault SpiritApplication) releases prior to 251126, where an administrator can inject arbitrary yt-dlp arguments through the /admin/api/saveConfig endpoint. The injected arguments are persisted globally and later concatenated into the yt-dlp command line assembled by YtDlpUtil.java, allowing OS command injection (CWE-78) that executes with the privileges of the StreamVault service when a download job runs. Exploitation requires a valid administrative session (CVSS PR:H), so anonymous remote attackers cannot reach it, but publicly available exploit code exists per the referenced GitHub security advisory GHSA-c747-q388-3v6m; there is no indication of confirmed active exploitation (CISA KEV), and the vulnerable argument-append feature was removed entirely in the subsequent 251226 release.
Reflected cross-site scripting (XSS) in sunkaifei FlyCMS userLogin function allows unauthenticated remote attackers to inject malicious scripts via the redirectUrl parameter, requiring user interaction to trigger. The vulnerability is publicly available for exploitation with a low CVSS score of 2.1 reflecting limited integrity impact, but active public PoC code exists and the affected project has not responded to disclosure.
Cross-site scripting (XSS) in sunkaifei FlyCMS Admin Login component allows remote attackers to inject malicious scripts via the redirectUrl parameter in IndexAdminController.java. The vulnerability requires user interaction (UI:P) and results in limited integrity impact (VI:L), with a very low CVSS score of 2.1 despite public exploit availability. Active exploitation risk is minimal given the low EPSS score (0.02%, 6th percentile) and requirement for social engineering the admin user.
Improper authorization in Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate the orderSn parameter in the submitOrderPayment function, potentially disclosing or modifying payment information for orders they do not own. The vulnerability requires valid user authentication and has publicly available exploit code; however, the EPSS score of 0.06% indicates exploitation is unlikely in practice despite the disclosed POC.
Improper access controls in Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose member information via the getMemberByMobile endpoint in MemberController.java. The vulnerability has publicly available exploit code and affects a core user management function, though the EPSS score of 0.04% suggests limited real-world exploitation despite public availability of proof-of-concept.
Improper authorization in the MemberController.deductBalance() function of Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate user balance operations without proper authorization checks, resulting in limited confidentiality impact. Public exploit code exists for this vulnerability, though the extremely low CVSS score (2.1) and EPSS percentile (15th) suggest minimal real-world exploitation risk despite public availability.
Improper access controls in the Order Payment Handler (orderService.payOrder method) of Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose sensitive information through the OrderController component. The vulnerability requires high attack complexity and authenticated access (PR:L), limiting real-world exploitation despite publicly available proof-of-concept code. EPSS exploitation probability is 0.06% (17th percentile), suggesting low practical risk despite public POC availability.
Arbitrary file read in the Takes web framework's TkFiles take (through version 2.0-SNAPSHOT) lets remote, unauthenticated attackers escape the configured file-serving base directory by inserting ../ sequences into the HTTP request path, disclosing files readable by the Java process. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms no authentication or user interaction is needed, and the impact is limited to confidentiality with no integrity or availability effect; the practical blast radius depends on how permissive the hosting process's OS-level file permissions are. Exploitation is straightforward for any internet-reachable TkFiles-backed endpoint, and publicly available exploit code exists (a detailed proof-of-concept report is linked from the NVD entry), but there is no indication of confirmed active exploitation in the wild and no CISA KEV listing.
Authenticated users on Turms IM Server v0.10.0-SNAPSHOT and earlier can exploit a broken access control flaw (CWE-284) in the handleQueryUserOnlineStatusesRequest() method to query arbitrary users' online status, device information, and login timestamps without proper authorization checks. The vulnerability requires a valid account (CVSS PR:L) and is remotely exploitable, with publicly available exploit code. The independent assessment rates it medium severity because it leaks presence metadata rather than message content or credentials.
Memory exhaustion denial of service in Turms AI-Serving (v0.10.0-SNAPSHOT and earlier) allows remote attackers to crash the service by uploading specially crafted compressed images that expand to gigabytes when loaded via OpenCV's imread() without dimension validation. The vulnerability is in the ExtendedOpenCVImage class, and publicly available exploit code exists. The risk is bounded to deployments that expose the OCR/image upload feature, and no authentication is required if that service is publicly accessible.
Improper file type validation in the Turms AI-Serving module (v0.10.0-SNAPSHOT and earlier) allows unauthenticated remote attackers to upload arbitrary files - executables, scripts, HTML documents, or web shells - to the OCR image-upload endpoint, because the OcrController's @FormData(contentType = MediaTypeConst.IMAGE) restriction validates only client-supplied Content-Type headers and file extensions rather than actual file content. Publicly available exploit code exists in the form of a published PoC report, and the issue carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N per NVD; our assessment adds a low integrity impact). The elevated outcomes sometimes attributed to this flaw - server-side code execution or stored XSS - are not guaranteed by the upload itself and only materialize if the deployment executes the upload directory or serves stored files back to users; a hardening-lacking deployment that does neither faces only arbitrary file storage.
JeecgBoot versions up to 3.9.0 allow authenticated remote attackers to manipulate user session management through the SysUserOnlineController, resulting in unauthorized session access with low availability impact. Public exploit code is available, though the CVSS score of 2.1 reflects limited real-world risk due to the requirement for authenticated access and minimal impact scope. Active exploitation has not been confirmed in CISA KEV, and the EPSS score of 0.13% indicates low probability of widespread exploitation despite public POC availability.
Authentication bypass in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate tenant ID arguments in the SysTenantController, resulting in improper authentication checks that grant unauthorized access to other tenants' data. The vulnerability has a low CVSS score of 2.1 but publicly available exploit code exists, suggesting active researcher interest despite minimal real-world impact signals (EPSS 0.32%, low severity scope). Exploitation requires prior authentication and produces only limited information disclosure within the multi-tenant architecture.
CRLF injection in Netty's io.netty.handler.codec.http.HttpRequestEncoder (netty-codec-http) allows an attacker-influenced request URI to be written verbatim into the outbound HTTP request line, enabling HTTP request smuggling against upstream/back-end servers. The flaw affects netty-codec-http versions prior to 4.1.129.Final and the 4.2.x line from 4.2.0.Alpha1 up to (but not including) 4.2.8.Final, and is unauthenticated per the CVSS vector (AV:N/PR:N/UI:N) with low confidentiality and integrity impact (CVSS 6.5). Publicly available exploit code exists, including a reproducer in the GitHub Security Advisory, and exploitation is conditional: it requires an application that uses HttpRequestEncoder (typically via HttpClientCodec) and passes unsanitized or attacker-controlled data into the request URI. There is no confirmed active exploitation (not in CISA KEV); Netty's default HTTP header validator blocks CRLF in headers but does not sanitize the URI.
SnailJob (aizuda snail-job), a Java-based distributed job scheduling platform, up to and including version 1.6.0 contains an injection flaw in QLExpressEngine.doEval, where attacker-supplied input is passed into the QLExpress expression engine without adequate neutralization (CWE-74). An attacker who is authenticated to the SnailJob console (CVSS PR:L) and can reach a feature that evaluates user-controlled QLExpress expressions - for example job workflow/decision or routing expression fields - can inject expression syntax remotely with no user interaction, achieving limited confidentiality, integrity, and availability impact as scored by the vendor (VulDB CVSS 4.0 base 5.3, Medium; independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit code has been identified at time of analysis, and the issue is fixed by upgrading to version 1.7.0-beta1 (commit 978f316c38b3d68bb74d2489b5e5f721f6675e86).
CRLF injection in code-projects Rental Management System 2.0 allows authenticated remote attackers to manipulate log entries via the Log Handler component in Transaction.java, enabling log tampering with minimal real-world impact. The vulnerability requires prior authentication (PR:L), has low integrity impact, and carries a very low EPSS score (0.07%) despite public exploit availability, suggesting exploitation is limited to specific threat scenarios.
Server-side request forgery in PowerJob up to version 5.1.2 allows authenticated remote attackers to manipulate the targetIp and targetPort arguments in the checkConnectivity function of the Network Request Handler component, enabling SSRF attacks with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite the public exploit availability, suggesting this vulnerability has seen limited active abuse.
Server-side request forgery in Yalantis uCrop 2.2.11 allows authenticated remote attackers to manipulate the downloadFile function in BitmapLoadTask.java URL handler, enabling arbitrary HTTP requests from the affected server. The vulnerability requires user authentication (PR:L) and carries limited confidentiality and integrity impact. Public exploit code exists, though the vendor has not responded to early disclosure attempts.
Okta Java SDK versions 11.0.0 through 20.0.0 allow concurrent ApiClient requests to cross-contaminate response status codes and headers, which can undermine access-control decisions in multithreaded applications. This is a timing-dependent race condition (CWE-362) that is not remotely exploitable against default deployments; exploitation requires an application that invokes ApiClient concurrently and bases authorization on its response status or headers. No public exploit or active exploitation has been identified, and EPSS is low at 0.21%, but a vendor patch is available in version 20.0.1 (GHSA text says 21.0.0+).
Remote code execution in XWiki Rendering versions prior to 16.10.10, 17.4.3, and 17.6.0-rc-1 allows any authenticated user with edit rights-including the ability to edit their own profile-to inject script macros via insufficiently escaped {{/html}} syntax. Successful exploitation enables arbitrary Groovy or Python macro execution, granting full read/write access to all wiki contents. Public exploit code is available (EPSS 1.02%, 62nd percentile), and though not confirmed actively exploited, the low privilege requirement makes immediate patching critical.
Unauthenticated remote attackers can degrade or render XWiki's REST API unavailable by requesting unbounded result sets from endpoints such as /rest/wikis/xwiki/spaces, which by default returns every space (effectively every page) in the wiki. Affected releases are 16.10.10 and below, 17.0.0-rc-1 through 17.4.3, and 17.5.0-rc-1 through 17.6.0; the impact is availability-only (CVSS 4.0 8.7, assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), scaling with wiki size and JVM memory configuration so large installations suffer the most. No public exploit code has been identified at time of analysis and EPSS is low (0.40%, 32nd percentile), but the flaw is trivially reachable without authentication on default configurations, and vendor patches are available in 16.10.11, 17.4.4 and 17.7.0-rc-1.
Reflected cross-site scripting in XWiki Platform's Flamingo Skin Resources and Web Templates lets an attacker craft a URL whose xredirect parameter is rendered unsafely into a deletion-confirmation message, executing attacker-controlled script when the victim clicks the "No" button. All instances of both packages from 6.2-milestone-1 through 16.10.9, and from 17.0.0-rc-1 through 17.4.1, are affected; the flaw no longer exists on 16.10.10, 17.4.2, or 17.5.0+. No attacker authentication is required (PR:N) but exploitation is interaction-dependent (UI:R), and while the base impact on a low-privileged victim is limited, a victim holding admin or programming rights can be leveraged to perform arbitrary actions, including remote code execution. Publicly available exploit code exists and EPSS estimates a low 0.51% probability (41st percentile), with no confirmed active exploitation in CISA KEV.
Memory and thread resource exhaustion in the Okta Java Management SDK 21.0.0 through 24.0.0 allows long-running, multithreaded applications to progressively degrade and eventually suffer a denial-of-service condition against themselves, because threads are not properly cleaned up after requests complete. Only applications that integrate the SDK's ApiClient in a multithreaded manner and run for extended periods under sustained load are at risk; short-lived processes, single-threaded integrations, and applications on 24.0.1 or later are unaffected. This is not an attacker-triggerable flaw but an availability defect that surfaces through the application's own normal operation, rated CVSS 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with a very low EPSS of 0.27% (17th percentile); no public exploit code or confirmed active exploitation has been identified at time of analysis, and this is a low-real-priority availability issue despite the network attack vector.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM as a Cloud Service and AEM 6.5 LTS - lets a low-privileged authenticated attacker execute arbitrary script in a victim's browser session, but only when two independent preconditions are met: the attacker holds a valid low-privilege AEM account and the victim is enticed into visiting a crafted URL or interacting with a manipulated page. The impact stays inside the victim's browser (low confidentiality and integrity, no availability loss, no server-side code execution), and the CVSS vector PR:L/UI:R confirms the authenticated, user-interaction-dependent attack path. Risk is low in practice: EPSS is 0.20% (9th percentile), the CVE is not in CISA KEV, and no public exploit has been identified at time of analysis.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and AEM 6.5 LTS) allows a low-privileged authenticated attacker to execute malicious scripts in a victim's browser after convincing the victim to visit a crafted URL or interact with a manipulated page. Exploitation requires both a valid low-privileged AEM account (PR:L) and victim user interaction (UI:R), confining impact to the victim's browser context with low confidentiality and integrity effects. No public exploit identified at time of analysis; EPSS is 0.20% (9th percentile), indicating low predicted exploitation likelihood. Our independent assessment rates this as a high-CVSS-name-but-modest-real-risk issue because the double gating meaningfully limits realistic exploitation.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they browse to the affected page. Exploitation requires a valid low-privileged account and a second user to view the crafted content, and the cross-context nature means the script runs in the victim's session, though with limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low at 0.20% (9th percentile), indicating a low-priority vulnerability.
Adobe Experience Manager 6.5.23 and earlier, including the 6.5 LTS build and AEM Cloud Service, is affected by stored cross-site scripting (CWE-79) in which a low-privileged, authenticated author can persist malicious JavaScript into vulnerable form fields that then executes in the browser of any user who browses the page hosting that field. Exploitation therefore requires two distinct parties: an attacker holding a valid AEM account with write access to the affected field (PR:L, so not anonymously reachable), and a separate victim who is induced or simply happens to visit the poisoned page (UI:R). Impact is confined to the victim's browser session - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N scores it 5.4 (Medium) with no server-side code execution - and no public exploit code has been identified at time of analysis, with EPSS at 0.20% (9th percentile) and no CISA KEV listing.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and AEM 6.5 LTS) allows a low-privileged, authenticated author to inject persistent JavaScript into form fields that executes in a victim's browser when that page is viewed. Per the assessed vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation requires a valid but low-privileged AEM authoring account plus a second user browsing to the poisoned page; impact is confined to client-side script execution with no server-side code execution or availability loss. No public exploit code has been identified and the flaw is not in CISA KEV; EPSS is 0.20% (9th percentile), reflecting low observed exploitation likelihood, and real-world exposure is further limited because AEM author instances are typically restricted to internal networks.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM as a Cloud Service and AEM 6.5 LTS - allows an attacker who already holds a high-privileged AEM account to plant malicious JavaScript in vulnerable form fields, which then executes in the browser of any user who browses to the page rendering that field. The privilege prerequisite (PR:H) and required victim interaction (UI:R) mean realistic exploitation is limited to insider abuse or a compromised author/administrator credential rather than an anonymous external attacker, and the vulnerability cannot be triggered by low-privilege or unauthenticated users. There is no public exploit code identified at time of analysis and no evidence of active exploitation; EPSS is 0.21% (roughly the 10th percentile), consistent with a low-priority, defense-in-depth issue rather than an urgent compromise vector.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and 6.5 LTS, allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields when a victim later visits the page rendering those fields. The CVSS vector confirms network reachability but requires low-privileged write access and victim interaction, so impact is limited to the victim's browser and there is no public exploit identified at time of analysis. EPSS is 0.20% (9th percentile), and all available signals indicate a genuinely low-priority issue despite the network attack vector.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they browse to the affected page. Exploitation requires valid author-tier credentials plus victim interaction, and impact is confined to the browser context with low confidentiality and integrity effects. No public exploit was identified at time of analysis, and EPSS is 0.20% (percentile 9%).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service allows an authenticated low-privilege author to persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any user who visits the page rendering that field. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4), exploitation requires a valid author-level account and a separate victim who interacts with the poisoned page, so it is not reachable by anonymous users and cannot fire without victim interaction; impact is confined to the victim's browser session within the AEM application, with no server-side code execution or availability impact. No public exploit identified at time of analysis, and EPSS is 0.20% (9th percentile), consistent with a genuinely low-priority issue despite the network attack vector; patch available per vendor advisory (Adobe APSB25-115).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM as a Cloud Service and the 6.5 LTS line) lets a low-privileged authenticated author inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later browses the page rendering that field. Exploitation requires a valid low-privileged AEM account plus victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4), so there is no unauthenticated or fully automated attack path; assessed impact is limited confidentiality and integrity loss within the victim's session. EPSS is low at 0.20% (9th percentile), the issue is not listed in CISA KEV, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets an authenticated low-privileged attacker inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who browses to the affected page. Exploitation is gated by two conditions - a valid low-privilege AEM account with content authoring/submission rights (PR:L) and victim interaction with the poisoned page (UI:R) - which keeps real-world risk modest despite the network attack vector. There is no public exploit identified at time of analysis and the EPSS score is only 0.20% (9th percentile), consistent with a low-priority, interaction-dependent issue.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they browse to the affected page. Exploitation requires both authoring access and victim interaction, and the EPSS score is 0.20% with no public exploit code identified at time of analysis. This is a genuine but low-priority vulnerability.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an attacker who already holds a low-privileged authenticated account inject malicious JavaScript into a form field that is persisted by the application. The script does not fire on injection but executes in the browser of a second user who later browses the page rendering the tainted field, which is why the vector requires user interaction (UI:R) on top of authentication (PR:L), with impact scoped to the victim's browser session (S:C, C:L/I:L/A:N) rather than the server. CVSS 3.1 scores it 5.4 and EPSS is only 0.20% at the 9th percentile, with no CISA KEV listing and no public exploit identified at time of analysis; this is a genuine but low-priority issue for a very high-footprint product, and the practical prerequisite of a valid low-privilege account plus a second user viewing the page keeps real-world risk modest.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets a low-privileged authenticated user inject malicious JavaScript into form fields, which then executes in the browser of any victim who later views the affected page. The flaw (CWE-79) is rated CVSS 5.4 with a scope change because the payload runs in the victim's browser session, and exploitation requires both an authenticated authoring account and a separate victim who browses to the compromised page. No public exploit code or confirmed active exploitation has been identified, and EPSS places the likelihood of exploitation in the bottom decile at 0.20% (9th percentile); consistent with this, all signals point to a genuine but low-priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets a low-privileged authenticated author persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the page rendering that field. Exploitation requires both an authenticated low-privilege AEM account capable of storing content and a victim who subsequently views the affected page, so it is not reachable pre-authentication and cannot fire without victim interaction. Scored CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), EPSS is low at 0.20% (9th percentile), and no public exploit or confirmed active exploitation was identified at time of analysis - this is a genuine but low-priority issue.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when the victim views the affected page. This affects AEM 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS. The vulnerability is low priority (EPSS 0.20%, 9th percentile) because exploitation requires an authenticated account and victim interaction; no public exploit identified at time of analysis.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) versions 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they view the affected page. Exploitation requires victim interaction and an authenticated account with content submission privileges, and the impact is confined to the browser (CVSS 5.4). No public exploit identified at time of analysis, and the vendor has released a security advisory (apsb25-115).
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious scripts into form fields, which execute in a victim's browser when they view the affected page. Exploitation requires authoring access and victim interaction, and no public exploit code or active exploitation has been identified; EPSS is low at 0.20%, making this a low-priority issue despite the 5.4 CVSS.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated author to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they browse to the affected page. Exploitation requires a valid AEM account with authoring access (PR:L) and victim interaction (UI:R), so it is not exploitable by unauthenticated attackers or without a victim visiting the page. No public exploit code or active exploitation has been identified, and EPSS is low (0.20%), making this a low-priority issue despite the medium 5.4 CVSS score.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (plus AEM Cloud Service and AEM 6.5 LTS) allows a low-privileged account - an author/contributor tier user with content submission rights - to persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who views the affected page. Rated CVSS 5.4 Medium (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the flaw is gated by two conditions: the attacker must be an authenticated provisioned author, and a victim must actively browse to the poisoned page, meaning scope change to a higher-privileged browsing session is possible but requires victim interaction. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and EPSS sits at just 0.20% (9th percentile), consistent with a genuine but low-priority issue; Adobe has published advisory APSB25-115.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated author to inject malicious JavaScript into form fields, which then executes in the browser of any user who visits the page rendering that field. Per the CVSS vector (PR:L/UI:R, scope changed), exploitation requires an existing AEM account with content-authoring rights plus victim interaction, and the resulting impact is confined to Low confidentiality and integrity loss in the victim's browser with no availability or server-side compromise. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the EPSS score of 0.20% (9th percentile) indicates a low predicted likelihood of exploitation in the near term.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious JavaScript into an affected form field, which executes in a victim's browser when that victim later browses to the page rendering the unsanitized field. Exploitation requires two conditions per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N): a valid low-privileged AEM account able to submit content into the vulnerable field, plus a victim who navigates to the poisoned page - so it is not exploitable pre-authentication and cannot fire against a passive target. Affected deployments include AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service; there is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score is only 0.20% (9th percentile), consistent with a genuinely low-priority issue despite its network attack vector.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) versions 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS, allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they view the affected page. Exploitation requires the attacker to have a valid low-privileged AEM account and the victim to interact with the compromised page, limiting real-world risk. The EPSS score is 0.25% (15th percentile) and no public exploit has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated low-privileged author to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of a victim who views the affected page. The vulnerability is rated CVSS 5.4 (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) and requires valid authoring/form-editing credentials plus victim interaction, so it is not exploitable by an anonymous remote attacker against a default configuration. No public exploit identified at time of analysis, and EPSS is 0.25% (15th percentile), suggesting low predicted exploitation activity.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets a low-privileged but authenticated content author plant malicious JavaScript inside vulnerable form fields; the script then executes in the browser of any user who later opens the affected page. Exploitation requires both an authoring-level account (PR:L) and a victim who browses to the poisoned page (UI:R), so it cannot be triggered pre-authentication or without user interaction, and impact is confined to the victim's browser with no server-side code execution. EPSS is very low (0.25%, 15th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, making this a low real-world-risk issue despite the recorded CVSS score of 5.4.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged user (PR:L) persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any other user who later views the page rendering that field (UI:R) - the payload is not self-triggering and requires a separate victim visit. Adobe Cloud Service and the 6.5 LTS track are also in scope, and the issue carries only limited confidentiality and integrity impact with no availability impact (CVSS 5.4), while EPSS is a low 0.25% (15th percentile) and no public exploit identified at time of analysis. Real-world priority is LOW-to-MEDIUM: exploitation presupposes legitimate author/contributor access to the AEM authoring environment plus a second user browsing the poisoned page.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and the 6.5 LTS line allows a low-privileged authenticated attacker to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Exploitation requires a valid low-privileged account with write access to a vulnerable form field and victim interaction (UI:R); EPSS is low at 0.25% (15th percentile) and no public exploit code has been identified, making real-world priority low despite the enterprise context.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated content author to inject malicious JavaScript into vulnerable form fields; the script executes in a victim's browser when that user browses to the affected page. Exploitation requires a valid low-privileged AEM account with content-authoring capability and victim interaction, so it is not unauthenticated or no-interaction exploitation. No public exploit identified at time of analysis, and EPSS is low at 0.25% (15th percentile).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged author inject malicious JavaScript into persistent form fields, which then executes in the browser of any user who views the affected page. Exploitation requires valid authoring credentials (PR:L, so unauthenticated attackers are excluded), a writable vulnerable form field, and a separate victim's interaction with the rendered page (UI:R); these prerequisites substantially limit realistic risk despite the context-dependent CVSS base of 5.4. No public exploit code has been identified and EPSS is 0.20% (9th percentile), and this CVE is not listed in CISA KEV, so there is no evidence of active exploitation at time of analysis. Affected deployments include AEM 6.5.23 and earlier, the AEM 6.5 LTS line, and AEM as a Cloud Service.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM 6.5 LTS and AEM Cloud Service) lets an authenticated, low-privileged author inject malicious JavaScript into form fields, which executes in the browser of any user who later views the affected page. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4), exploitation is double-gated: the attacker must already hold a valid low-privilege AEM account with content-editing capability, and the victim must browse the poisoned page, so this is not a remote unauthenticated attack. Risk is low: no public exploit code has been identified at time of analysis, there is no CISA KEV entry, and EPSS is 0.25% (15th percentile); impact is confined to the victim's browser session with low confidentiality and integrity loss and no availability effect.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier allows an authenticated, low-privileged authoring user to inject and persist malicious JavaScript through vulnerable form fields, which then executes in the browser of any victim who browses to the page rendering that field. Exploitation is not pre-authentication: it requires a valid low-privileged AEM account with authoring access (PR:L) and a victim who subsequently visits the affected page (UI:R), and the injected script runs in the context of the victim's session, giving it scope-changing but limited confidentiality and integrity impact (S:C/C:L/I:L/A:N). EPSS is only 0.25% (15th percentile), and no public exploit code or confirmed active exploitation has been identified at time of analysis, making this a low real-world-risk issue despite the high-profile product; the practical exposure is concentrated in deployments where lower-trust authors can edit form components.
Adobe Experience Manager 6.5.23 and earlier, including the Cloud Service and 6.5 LTS tracks, can be abused by an authenticated low-privileged user to store malicious JavaScript in vulnerable form fields, which then executes in the browser of a victim who later visits the affected page and produces limited confidentiality and integrity impact in that session. Exploitation requires prior low-privilege authentication and a victim page visit, no public exploit code or CISA KEV entry was identified at time of analysis, and the EPSS score is 0.25% at the 15th percentile, making this a genuine but low-priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service allows an authenticated low-privileged author (CVSS PR:L) to persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page (UI:R). The impact is limited to the victim's browser session - no server-side code execution or availability loss is possible, and the scope change (S:C) reflects script execution in the victim's origin rather than any compromise of the AEM server. Exploitation is not pre-authentication and requires a second, interacting victim; EPSS is 0.25% (15th percentile), there is no CISA KEV entry, and no public exploit code has been identified at time of analysis, making this a low-priority, patch-driven remediation item.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets a low-privileged, authenticated attacker persist malicious JavaScript inside vulnerable form fields, which then executes in the browser of any user who later views the affected page. Exploitation requires two independent conditions - a valid low-privileged AEM account able to submit or edit content in the affected field (PR:L), plus a victim who subsequently browses to the rendering page (UI:R) - so this is a genuine-but-low-priority vulnerability with impact limited to the victim's browser session (C:L/I:L, no availability impact). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.25% (15th percentile), consistent with low predicted exploitation activity. It affects AEM 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS branch.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Exploitation requires both an authenticated account with content-editing privileges and victim interaction, limiting the attack to browser-based impacts such as session theft or page defacement rather than server compromise. No public exploit code is identified at time of analysis, and the EPSS score is 0.25% (15th percentile), indicating a low likelihood of exploitation; CISA KEV does not list this CVE.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier lets an authenticated low-privileged user - such as an author or content contributor with write access to a vulnerable form field - persist malicious JavaScript that then executes in the browser of any user who later loads the affected page. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms two prerequisites: an attacker account on the AEM instance (PR:L) and a separate victim who browses to the injected page (UI:R); because the payload is stored, no crafted link is needed and the script re-fires on each page view. Impact is limited to client-side execution within the victim's browser session (C:L/I:L, no server-side code execution and no availability impact), and with no CISA KEV listing, no public exploit code identified at time of analysis, and a low EPSS score of 0.20% (9th percentile), this is a low real-world priority despite the high-value nature of the platform.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated user to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who browses to the page rendering that content. Exploitation is a two-step chain requiring both a low-privileged account permitted to submit or edit content in the affected form field (PR:L) and a victim who views the resulting page (UI:R), so impact is confined to client-side script execution in the victim's session with no server-side code execution. This is a genuine but low-priority vulnerability: EPSS is only 0.25% (15th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, and the score is CVSS 5.4 with scope change but only low confidentiality and integrity impact.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious JavaScript into form fields, which then executes in the browser of a victim who visits the affected page. The attack requires a valid low-privileged account to persist the payload and a victim to interact with the crafted content, as reflected by the CVSS vector PR:L/UI:R. No public exploit identified at time of analysis, and the EPSS score is 0.25% (15th percentile), consistent with a genuine but low-priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM Cloud Service and the AEM 6.5 LTS branch - lets an attacker who already holds a low-privileged authenticated account inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who views the page rendering that field. Exploitation requires two conditions to line up: a valid low-privilege AEM login capable of writing to the affected field (PR:L), and a victim navigating to the poisoned page (UI:R), so there is no unauthenticated or zero-interaction path. Scoring is CVSS 5.4 with EPSS at 0.25% (15th percentile), and no public exploit identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated, low-privileged user to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any other user who views the affected page. Successful exploitation requires an account on the AEM instance (CVSS PR:L) plus victim interaction (UI:R), and the scope change in the CVSS vector (S:C) reflects that the injected script runs in the victim's browser context rather than the vulnerable component's own security context. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is very low at 0.25% (15th percentile), making this a genuinely low-priority finding despite the network attack vector.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) 6.5.23 and earlier allows an authenticated attacker with low-privilege content-authoring access to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Exploitation requires the victim to interact with the crafted page (UI:R) and the attacker to have a valid low-privileged account (PR:L), so it is not unauthenticated or remote-exploitable without credentials. No public exploit code has been identified at time of analysis, and EPSS is low at 0.25%, making this a genuine but low-priority issue for most deployments.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page. Exploitation requires two independent gates as assessed: a valid low-privileged AEM account able to submit content into the vulnerable field (PR:L per the CVSS vector), and a separate victim who must browse to the page rendering that stored payload (UI:R), which substantially limits realistic risk despite the network attack vector. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.25% (15th percentile), so this is best treated as a persistent-but-conditional content-injection issue rather than an urgent, remotely exploitable flaw.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and the 6.5 LTS track) lets a low-privileged authoring user persist malicious JavaScript into form fields, which then executes in the browser of any user who later views the affected page. Exploitation is not remote and unauthenticated: per the CVSS vector PR:L the attacker must already hold an authenticated AEM account able to submit content into the vulnerable fields, and per UI:R a separate victim must browse to the page rendering that stored content, with impact confined to limited confidentiality and integrity loss in the victim's session (scope change S:C, no availability impact). Risk is low in practice - EPSS is 0.25% (15th percentile), the issue is not in CISA KEV, and no public exploit code was identified at time of analysis - although Adobe tracked it under its APSB25-115 security bulletin, so patched builds are available from the vendor.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets an attacker with a valid low-privileged account persist malicious JavaScript inside vulnerable form fields; the script then executes in the browser of any higher-privileged user who views the affected page. The author-input prerequisite (PR:L) and the requirement that a victim navigate to the poisoned page (UI:R) substantially limit practical impact, no server-side code execution or availability loss is possible, and no public exploit has been identified at time of analysis. EPSS is 0.25% (15th percentile), consistent with a low-likelihood, targeted-abuse scenario rather than mass exploitation.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and AEM 6.5 LTS) lets a low-privileged authenticated user persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any victim who later views that page. The CVSS vector (PR:L/UI:R/S:C) confirms that the attacker must already hold a valid account with rights to submit or edit the affected form field, and that the payload only fires when a victim browses to the poisoned page - the injected script crosses into the victim's authenticated session (S:C) but yields only limited confidentiality and integrity impact (C:L/I:L) with no server-side code execution or availability loss. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.25% (15th percentile), consistent with our assessment that this is a genuinely low-priority issue despite its network attack vector.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they visit the page containing the field. The vulnerability requires a valid low-privileged authoring account and a separate victim user to interact with the page, limiting its real-world impact; no public exploit has been identified at the time of analysis and the EPSS score is 0.25% (15th percentile).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS, allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields; the script executes in a victim’s browser when that user browses to the page containing the injected field. Exploitation requires both a low-privileged AEM account (PR:L) and victim interaction (UI:R), and no public exploit has been identified at time of analysis. EPSS is 0.25% (15th percentile), consistent with a low-priority issue despite the network attack vector.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier - including the 6.5 LTS line and AEM Cloud Service - lets a low-privileged authenticated user persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any user who later views that page. Both preconditions from the assessed CVSS vector must hold: the attacker needs a low-privileged authenticated account with write access to the affected field (PR:L), and a victim must browse to the rendered page (UI:R), so this is not exploitable against anonymous or unauthenticated configurations. Impact is confined to low confidentiality and low integrity with a scope change (the script runs in the victim's browser context), and there is no evidence of active exploitation - no CISA KEV listing and no public exploit identified at time of analysis - with EPSS at 0.25% (15th percentile), consistent with a low-priority issue despite the wide deployment base of the product.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and the 6.5 LTS line, allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when that user views the affected page. Exploitation requires a valid low-privileged AEM account (PR:L) and victim user interaction (UI:R), and impact is limited to client-side script execution with low confidentiality and integrity effects and no availability impact; CVSS is 5.4, EPSS is 0.25% (15th percentile), and no public exploit identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged user plant malicious JavaScript in vulnerable form fields, which then executes in the browser of any user who later browses to the page rendering that field. Because exploitation requires a valid account (CVSS PR:L) and victim interaction (UI:R), and the impact is confined to the victim's browser rather than the server, this is a genuine but low-priority vulnerability; no public exploit code has been identified at time of analysis and EPSS is 0.25% (15th percentile), with no evidence of active exploitation. The same weakness is reported against AEM Cloud Service and 6.5 LTS in the vendor CPE data, and Adobe documents the fix in advisory APSB25-115.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged author to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they visit the affected page. This issue also affects AEM Cloud Service and AEM 6.5 LTS, but exploitation requires a valid authoring account and victim user interaction, limiting realistic impact to insider or compromised-author scenarios. EPSS is very low (0.25%, 15th percentile), and no public exploit has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated low-privileged user with rights to edit form fields to persist malicious JavaScript that executes in a victim's browser within the AEM origin when the victim views the affected page. Successful abuse is bounded by two prerequisites: a valid low-privileged AEM account (PR:L) and victim interaction (UI:R), so a second user must browse to the poisoned form field for the payload to fire; impact is limited to client-side script execution with low confidentiality and integrity effects and no availability impact. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); EPSS is 0.20% (9th percentile), indicating low predicted exploitation likelihood in the near term, though the stored (persistent) nature of the XSS means any single successful injection can affect many downstream viewers of the page.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated user to place script that executes in a victim's browser inside the AEM origin once that victim opens a crafted URL or interacts with a manipulated page. The flaw is client-side only, gated by two conditions - an authenticated low-privilege account on the AEM instance plus victim user interaction - and yields Low confidentiality and integrity impact with no availability effect, which is why the assessed real-world risk profile is genuinely low despite the network attack vector. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is only 0.27% (18th percentile), indicating very little observed exploitation pressure. Affected deployments span AEM 6.5 LTS, AEM Cloud Service, and the general 6.5 line at 6.5.23 and earlier; Adobe documents the fix in security bulletin APSB25-115.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets a low-privileged authenticated attacker inject malicious script that executes in a victim's browser when the victim visits a crafted URL or interacts with a manipulated page. Impact is confined to the victim's browser context (low confidentiality and integrity, no availability or server-side code-execution impact), and exploitation requires both a valid low-privileged AEM account and victim interaction, which substantially limits realistic exposure. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and the issue is not listed in CISA KEV.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged author inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page. Because the payload is persisted and the attack requires a victim to browse to the poisoned page, exploitation depends on multi-user authoring workflows and offers limited confidentiality and integrity impact (CVSS 5.4, S:C, PR:L, UI:R). Risk is low in practice: the EPSS score is 0.25% (15th percentile), there is no evidence of active exploitation, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated user to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who browses to the page rendering that field. Exploitation is not anonymous: the CVSS vector (PR:L) requires a valid low-privileged AEM account, and success depends on a victim subsequently visiting the affected page (UI:R), limiting impact to Low confidentiality and integrity effects within the victim's browser session with no availability impact. Risk is therefore low priority - EPSS is only 0.20% (9th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets a low-privileged authenticated user inject JavaScript into vulnerable form fields, which then executes in the browser of any victim who later views the affected page. Exploitation requires two actors-an authenticated attacker who can write to the form field (PR:L per the CVSS vector) and a separate victim who browses to the rendered page (UI:R)-and the injected payload persists until the field content is cleaned. Impact is limited to the victim's browser session (C:L/I:L, A:N) rather than server-side execution; EPSS is 0.20% (9th percentile), no public exploit code or CISA KEV entry is associated with this CVE, and Adobe's advisory APSB25-115 documents the fix.
DOM-based cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged attacker execute malicious scripts in a victim's browser, but only if the victim visits a crafted URL or interacts with a manipulated page. The flaw is client-side only, yielding limited confidentiality and integrity impact with no availability impact. No public exploit code has been identified (EPSS 0.20%, 9th percentile), and the combined authentication and user-interaction requirements significantly limit real-world exploitation.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and the 6.5 LTS build) lets a low-privileged attacker inject malicious script that executes in a victim's browser session. Exploitation requires two conditions: a valid low-privileged account on the AEM instance (PR:L) and victim user interaction, such as visiting a crafted URL or interacting with a manipulated page (UI:R). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.25% (15th percentile), consistent with a low-priority, interaction-dependent bug.