Cross-Site Scripting

Stored cross-site scripting in zhitan-ems 1.0.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by uploading a malicious SVG file through the /equipmentFile/upload endpoint. SVG files support embedded script content, and the application fails to sanitize or restrict SVG payloads before serving them, causing the browser to execute attacker-controlled code in the application's origin context. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (3rd percentile) indicates minimal observed exploitation activity.

Stored XSS in the decidim-elections Ruby gem (versions before 0.32.0) allows a process-scoped admin or election editor with question-management rights to persist arbitrary JavaScript in election question body fields, which subsequently executes in the browsers of all public visitors and voters accessing affected election pages. The root cause is the `question_title` helper in `application_helper.rb` returning `question.body` marked `.html_safe` without any sanitization boundary, bypassing Rails' automatic HTML escaping. No public exploit code and no active exploitation (CISA KEV) have been identified; the issue was discovered through a formal security audit commissioned by the Decidim Association.

Stored Cross-Site Scripting in LF Edge eKuiper (versions prior to 2.4.0) allows an authenticated API user to inject arbitrary HTML or JavaScript into external service names, which execute in any administrator's browser when the administrative web UI renders the unescaped identifier. Successful exploitation can lead to session token exfiltration or unauthorized browser-context actions on behalf of the viewing administrator. A detailed public proof-of-concept exists in GitHub Security Advisory GHSA-g8rh-fjm6-h2h9; no active exploitation has been confirmed by CISA KEV at time of analysis.

Stored cross-site scripting in MaxSite CMS versions 0.94 through 109.6 stems from the admin_page plugin's upload handler accepting unrestricted HTML file uploads, placing attacker-controlled content in a publicly accessible web directory. Any authenticated low-privilege user can upload an HTML file containing malicious JavaScript to uploads/_pages/, where it executes in visitors' browsers upon access. A publicly available proof-of-concept exploit exists; active exploitation has not been confirmed in CISA KEV, but the persistent execution path and low-privilege requirement make this a realistic risk for multi-author deployments.

Script injection via alternate XSS syntax affects Dell Secure Connect Gateway (SCG) 5.0 in both Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) editions, as disclosed in Dell advisory DSA-2026-382. An unauthenticated remote attacker exploiting CWE-87 can bypass the application's standard XSS filters using alternative injection syntax, causing malicious scripts to execute in the context of affected users' browsers and potentially enabling session hijacking or credential exfiltration. No public exploit code and no CISA KEV listing have been identified; Dell has released patches for both product variants.

Session fixation in tirreno versions prior to 0.10.0 allows an attacker who can inject a known session identifier into a victim's browser to hijack that victim's authenticated session. The framework's authentication flow validates credentials and establishes a session but omits the PHP session_regenerate_id() call, so the same token that existed before login remains valid after it. No public exploit code has been identified; exploitation requires a prerequisite attack capability such as network man-in-the-middle access, a companion cross-site scripting flaw, or subdomain cookie injection.

Stored XSS in Snipe-IT before 8.7.0 allows authenticated users holding departments.edit permission to plant malicious JavaScript in department names that executes in every department member's browser when they load the My Assets page. The flaw exists because DepartmentPresenter::formattedNameLink() omits HTML encoding in the fallback branch triggered when the viewing user lacks departments.view permission. Vendor-released patch 8.7.0 is available; no public exploit code has been identified at time of analysis.

Script injection in Dell Secure Connect Gateway (SCG) 5.0 exposes organizations running either the Appliance (prior to 5.36.00.16) or Application (prior to 5.36.00.00) builds to unauthenticated remote exploitation via alternate XSS syntax. An attacker can bypass the product's XSS neutralization controls using non-standard or alternate encoding forms, resulting in script injection with limited confidentiality impact per the CVSS C:L assessment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Cross-site scripting in OpenText Documentum Webtop versions prior to 16.7.1 allows an authenticated attacker to inject malicious scripts into the application that execute in a victim user's browser upon interaction with attacker-controlled content. The CVSS 4.0 vector (PR:L/UI:A) confirms exploitation requires both a valid account and active victim engagement, constraining the realistic attack surface to insider threats or compromised accounts. No public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in the myCred gamification plugin for WordPress allows authenticated contributors to inject persistent malicious scripts via the 'wrapper' shortcode attribute in the sell-content addon. All plugin versions through 3.2.4 are affected. Any site visitor who loads a page containing the poisoned shortcode will execute the attacker's payload in their browser, enabling session hijacking, credential theft, or admin account compromise. No public exploit or KEV listing is present at time of analysis, but the contributor-level prerequisite is a low bar on sites with open registration.

Stored cross-site scripting in Lumi Education UG's h5p-nodejs-library (all versions prior to 10.0.4) allows an authenticated user with H5P content upload access to embed malicious JavaScript inside an H5P package, which then executes in the browsers of any subsequent users who view that content. The CVSS 4.0 vector (SC:H/SI:H) reflects that the primary damage lands on victim browsers - enabling session hijacking, credential theft, or arbitrary DOM manipulation - rather than on the server itself. No public exploit identified at time of analysis, though the CVSS 4.0 E:P supplemental metric indicates exploit code or proof-of-concept exists.

Stored cross-site scripting in the Orbit Fox WordPress plugin (before version 3.0.9) allows users holding at minimum contributor-level access to inject arbitrary JavaScript by supplying an unsanitized HTML tag name within a Beaver Builder widget, with the malicious script persisting in page markup and executing in the browser of every subsequent visitor. The vulnerability carries a CVSS 5.4 Medium score and a publicly available proof-of-concept has been confirmed by WPScan, lowering the bar for exploitation on multi-author sites. No active exploitation is confirmed in CISA KEV at time of analysis, and the EPSS score of 0.15% reflects low automated exploitation probability.

Stored cross-site scripting in the Sina Extension for Elementor WordPress plugin (versions before 3.10.4) allows authenticated users holding at least a Contributor role to inject persistent malicious scripts via an unescaped Table widget setting that is rendered inside an HTML attribute. When a higher-privileged user - such as an Editor or Administrator - views the affected page, the attacker-controlled script executes in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site. A publicly available proof-of-concept exists via WPScan, though EPSS stands at 0.15% (5th percentile) and no active exploitation is confirmed in CISA KEV.

Stored Cross-Site Scripting in the Content Mask WordPress plugin before 1.8.5.6 allows any user holding at least a Contributor-level WordPress account to inject persistent malicious scripts into post content, which then execute in the browsers of all users - including administrators - who view or preview the affected page. Notably, the plugin's own built-in role-restriction feature fails to block the attack, widening the exploitation surface beyond what site operators may expect. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.16% (6th percentile) and SSVC 'exploitation: none' indicate no observed mass exploitation at time of analysis.

Stored Cross-Site Scripting in the WP Crowdfunding WordPress plugin (≤2.2.1, by Themeum) allows authenticated subscribers to inject persistent JavaScript via the `first_name` parameter in the plugin's user profile dashboard. When an administrator views the attacker's user profile via the `?show_user_id=` URL parameter, the payload executes in the admin's browser session, enabling cross-privilege script execution from a subscriber-level account to an administrative context. No public exploit code has been identified and the CVE is absent from CISA KEV, though a patch commit exists in the plugin SVN repository.

Stored Cross-Site Scripting in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.5) allows authenticated contributor-level users to inject persistent arbitrary JavaScript into episode pages via the episode_contributor comment parameter. The vulnerability is compounded by two design flaws: contributor comments are stored in a plugin-managed custom database table that bypasses WordPress core's wp_kses_post sanitization filter, and the save_post hook fires without a nonce check, removing CSRF protection that would otherwise limit exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.

Reflected Cross-Site Scripting in the User Access Manager WordPress plugin (all versions through 2.3.18) allows unauthenticated attackers to inject arbitrary JavaScript via the unsanitized 'tab_group_section' GET parameter rendered in admin settings views. Successful exploitation requires tricking a privileged WordPress user - most dangerously an administrator - into clicking a crafted URL, at which point the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Wordfence has published full technical details including vulnerable source line references, lowering the barrier for independent exploitation.

Stored Cross-Site Scripting in the My Calendar - Accessible Event Manager WordPress plugin (≤3.8.3) allows any authenticated contributor to inject persistent JavaScript into site pages via unsanitized shortcode attributes. The payload executes in the browsers of all users who subsequently visit the affected page, potentially enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed; an upstream fix commit is available on GitHub though a tagged release version has not been independently confirmed.

Stored Cross-Site Scripting in the My Calendar - Accessible Event Manager WordPress plugin (all versions through 3.8.3) allows authenticated contributors to inject persistent malicious scripts via the `fallback`/`substitute` shortcode attributes. The attack exploits a gap between WordPress's save-time and render-time processing: hex-encoded payloads like `\x3cscript\x3e` pass through `wp_kses_post` as harmless literal strings at save time, but WordPress core's `shortcode_parse_atts()` calls `stripcslashes()` at render time, converting those sequences into live angle brackets before they reach the unescaped output sink. No public exploit code or active exploitation (CISA KEV) has been confirmed; the scope-changed CVSS 6.4 rating reflects impact on any visitor to an injected page.

Reflected Cross-Site Scripting in the Product Filter for WooCommerce by WBW WordPress plugin (woobewoo) allows unauthenticated network attackers to inject arbitrary JavaScript via the unsanitized 'wpf_fid' parameter. All plugin versions through 3.4.2 are affected on any WordPress/WooCommerce installation running the plugin. Successful exploitation requires social engineering - a victim must click a crafted URL targeting a store page where the plugin's filter recalculation output is rendered - enabling session hijacking, credential theft, or further escalation against authenticated users including store administrators.

Stored Cross-Site Scripting in the Graphina - Charts and Graphs For Elementor WordPress plugin (all versions through 3.1.11) allows authenticated contributors to inject persistent malicious scripts via the 'iq_tree_tree_chart_template' widget setting. Because the scope changes (S:C), injected payloads execute in the browser context of any visitor who loads the affected page, enabling session hijacking, credential theft, or drive-by malware delivery. The vulnerability stems from insufficient sanitization of widget input and missing output escaping in the TreeChart rendering path, with specific vulnerable code identified by Wordfence at TreeChart.js:146, tree-chart.php:19, GraphinaFunction.php:1653, and GraphinaElementorControls.php:1446. No public exploit code or CISA KEV listing is confirmed at time of analysis.

Cross-site scripting in Google Chrome's SanitizerAPI (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to bypass the browser's web origin policy by serving a crafted HTML page to a victim. The SanitizerAPI is Chrome's browser-native HTML sanitization interface; a flaw in its processing allows certain crafted inputs to violate same-origin restrictions, enabling limited cross-origin data exposure. With CVSS 4.3 (Medium), an EPSS of 0.27%, no KEV listing, and no public exploit code identified, this is a low-urgency but confirmed patch target.

Stored cross-site scripting in the announcement preview component of REBUILD 4.4.3 allows an authenticated user who can author announcement content to run arbitrary JavaScript in the browsers of anyone who views the affected announcement — potentially including the dashboard, activity feed, or login page depending on the announcement's visibility settings. The server correctly HTML-escapes the announcement body, but the client-side preview code reverses those escapes via jQuery's html().text() chain and then re-injects the decoded string into the DOM, defeating the server-side defense. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS is very low at 0.15% (4th percentile), indicating limited expected mass exploitation.

Stored XSS in money-pos 1.0 allows a low-privileged attacker with product-creation access to inject malicious JavaScript into order log entries via an unsanitized goodsName parameter during return processing. The payload persists server-side and executes in the browser of any administrator who views the order logs, because the Vue.js frontend renders the log description through v-html without sanitization. No public exploit code has been identified at time of analysis, and EPSS at 0.16% signals negligible automated exploitation probability.

Cross-site scripting in Silverpeas Core <=6.4.6 enables attackers to inject malicious JavaScript via the Multimedia library application's introduction field, executing arbitrary scripts in victim users' browser contexts. The scope-changed CVSS vector (S:C) confirms the payload crosses security boundaries, affecting any authenticated user who views the injected library introduction. No active exploitation is confirmed and the EPSS score of 0.15% at the 4th percentile reflects very low current exploitation probability.

Cross-site scripting in Silverpeas Core <=6.4.6 allows script injection through the CKEditor WYSIWYG image upload feature, executing attacker-controlled JavaScript in victims' browsers. The scope-changed (S:C) vector confirms the injected script runs in a different origin context, enabling session theft, credential harvesting, or malicious UI redirection against authenticated platform users. EPSS stands at 0.15% (4th percentile), indicating minimal observed exploitation activity; no public exploit code or CISA KEV listing exists at time of analysis.

Cross-site scripting in Silverpeas Core 6.4.6 exposes other authenticated users to session hijacking or credential theft via the document management file upload feature. The scope-changed CVSS vector (S:C) confirms the injected script executes in a different security context than the upload origin, enabling impact beyond the uploading user's own session. No public exploit or active exploitation has been confirmed; EPSS at 0.15% (4th percentile) indicates very low current exploitation probability.

Cross-site scripting in HTML::FormHandler before 0.410002 for Perl allows unauthenticated remote attackers to inject JavaScript into rendered pages when application field attributes are derived from user-controlled data. The root cause is the `process_attrs` method in `HTML/FormHandler/Render/Util.pm`, which formats attribute key-value pairs via `sprintf('%s="%s"', $attr, $value)` without encoding, letting a double-quote character break out of the attribute context and inject event handlers. The fix - encoding double quotes and ampersands via `HTML::Entities::encode_entities` - is confirmed merged and released as version 0.410002 on CPAN.

Reflected XSS in HTML::FormHandler before 0.410002 allows unauthenticated network attackers to inject JavaScript into rendered Perl web application pages by submitting form input containing script content. The Table form layout and Bootstrap 2 and 3 wrappers interpolated error strings - including rejected field values - directly into HTML without HTML-entity encoding, an incomplete fix relative to CVE-2026-19872 (which patched equivalent paths in other layouts in version 0.410000). No public exploit is identified and EPSS is 0.19%; risk is limited to applications using the three affected widget modules.

Stored and reflected cross-site scripting in HTML::FormHandler before 0.410002 (Perl/CPAN) allows attacker-influenced text in form option labels to execute arbitrary JavaScript in victims' browsers. The Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup widgets passed group labels and individual option labels directly into rendered HTML without applying HTML encoding, meaning any application that builds option lists from database records, user submissions, or dynamic sources exposes those label values as live markup. No public exploit code has been identified, but the patch commit and oss-security disclosure provide full technical detail on the affected rendering paths.

Stored cross-site scripting in OpenSearch Dashboards' Vega visualization engine allows an authenticated user with dashboard write permissions to plant malicious JavaScript that executes in the browser session of any user who subsequently views the crafted dashboard. The `checkForFunctionProperty` input validation routine failed to recurse into arrays of objects, so a JavaScript function nested within an array structure silently bypassed sandbox enforcement. Fixed in versions 2.19.5 (2.x branch) and 3.6.0 (3.x branch) per AWS security bulletin 2026-102; no public exploit code or CISA KEV listing identified at time of analysis.

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to permanently inject malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected deployments include AEM 6.5 LTS up to SP2, AEM 6.5 up to 6.5.24, and AEM as a Cloud Service up to 2026.7.0, per Adobe advisory APSB26-98. No public exploit or active exploitation has been identified at time of analysis, though the low-complexity attack path and broad AEM deployment make this a meaningful persistent threat in content-rich enterprise environments.

Reflected cross-site scripting in Adobe ColdFusion 2025 (through Update 12) and ColdFusion 2023 (through Update 23) enables an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The scope-changed nature of this flaw (S:C) confirms the vulnerability crosses the server's trust boundary into the victim's browsing session, enabling session token theft, credential harvesting, or forced UI manipulation. Adobe's APSB26-119 security bulletin addresses this vulnerability; no active exploitation (KEV) or public exploit code has been identified at time of analysis.

Stored Cross-Site Scripting in Adobe Experience Manager 6.5 LTS (≤SP2), AEM 6.5 (≤6.5.24), and AEM as a Cloud Service (≤2026.7.0) allows a low-privileged authenticated attacker to persist malicious JavaScript in vulnerable form fields of the authoring interface. When any other authenticated user visits the page containing the injected payload, the script executes in their browser under the site's origin with a changed scope, enabling session token theft or unauthorized actions on the victim's behalf. No public exploit code or active exploitation is identified at time of analysis.

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released patches under advisory APSB26-98; no public exploit or CISA KEV listing is identified at time of analysis.

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious scripts into vulnerable form fields. When any user - including administrators - subsequently browses the affected page, the injected JavaScript executes in their browser context, enabling session hijacking, credential theft, or UI redress attacks. Affected versions span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-browses a page containing the injected content, the script executes in their browser, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. The scope-changed CVSS vector confirms the attack crosses security boundaries, affecting users beyond the injecting account. No public exploit code and no CISA KEV listing are present at time of analysis.

Stored cross-site scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes silently in any victim's browser upon page load. The vulnerability spans AEM 6.5 up to 6.5.24, AEM 6.5 LTS up to SP2, and AEM as a Cloud Service up to build 2026.7.0, per Adobe security bulletin APSB26-98. Because the scope changes to the victim's browser context, a successful injection enables session token theft, credential harvesting, or further client-side attacks against any user - including administrators - who visits the poisoned content.

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser when they navigate to the affected page. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change flag (S:C) signals that injected scripts escape the AEM application trust boundary and execute in the victim browser's security context; no public exploit has been identified at time of analysis.

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields across the authoring interface. When any victim - including higher-privileged users such as administrators - browses to the page rendering the stored payload, the script executes in their browser, enabling session token theft, unauthorized content manipulation, or further actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; Adobe has released fixes via security advisory APSB26-98.

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in any victim's browser that subsequently navigates to the affected page. The scope-changed CVSS vector (S:C) confirms that injected scripts operate within the victim's browser security context, enabling session hijacking, credential theft, or unauthorized AEM actions against higher-privileged users. Adobe has issued advisory APSB26-98 covering AEM as a Cloud Service, AEM 6.5, and AEM 6.5 LTS; no public exploit code has been identified at time of analysis.

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in any victim's browser upon visiting the affected page. Affected versions span AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0), as documented in Adobe advisory APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser that renders the affected page. The vulnerability affects AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit code or active exploitation has been identified at time of analysis, and Adobe has addressed this in advisory APSB26-98.

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields. When any victim user browses to the affected page, the script executes in their browser within a changed scope context - enabling session theft, credential harvesting, or UI redressing against higher-privileged users. No public exploit code and no CISA KEV listing at time of analysis, but the low complexity and network accessibility make this straightforward to exploit by any authenticated user with form-submission rights.

Stored XSS in Adobe Experience Manager enables a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields within the content authoring interface. When any user - including privileged editors or administrators - navigates to the affected page, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized actions on their behalf. Adobe addressed this under advisory APSB26-98; no public exploit or CISA KEV listing has been identified at time of analysis.

Stored XSS in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user-including administrators-visits the page containing the injected content, the script executes in their browser under a changed scope (S:C), enabling session theft, credential harvesting, or unauthorized actions on behalf of the victim. Affected are AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit or active exploitation is identified at time of analysis.

Stored Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject persistent malicious JavaScript into vulnerable form fields. When any user - including administrators - browses to pages containing the poisoned fields, the injected script executes in their browser under the AEM origin, enabling session token theft, credential harvesting, or UI redirection. Three deployment lines are affected: AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. No public exploit code or active exploitation has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated low-privilege attackers to inject and execute arbitrary JavaScript within a victim's browser by manipulating the client-side DOM environment. Affected deployments span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed CVSS vector indicates successful exploitation can cross session boundaries, enabling session token theft or unauthorized actions beyond the attacker's direct privilege level - though exploitation requires both a valid AEM credential and victim interaction via a crafted page. No public exploit code and no CISA KEV listing exist at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager enables authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks without sanitization. Affected releases span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe addressed this in security bulletin APSB26-98; no confirmed active exploitation or public proof-of-concept code has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated low-privilege attackers to execute arbitrary JavaScript in the browser context of targeted users who visit a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Adobe addressed this in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the DOM environment through a crafted webpage. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. No public exploit code or active exploitation has been identified at time of analysis; vendor patch is documented under Adobe APSB26-98.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject malicious JavaScript that executes within a victim's browser context, with scope changing beyond AEM's own origin. Three product lines are affected: AEM 6.5, AEM 6.5 LTS, and AEM as a Cloud Service through their respective latest releases at time of disclosure. Exploitation requires user interaction - the victim must navigate to an attacker-crafted URL while authenticated - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-changed CVSS vector indicates impact can extend beyond the AEM application boundary into the victim's broader browser session; no public exploit has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the client-side DOM environment via a crafted URL or webpage. All three AEM delivery models are affected - on-premises 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has published Security Bulletin APSB26-98 addressing this issue; no public exploit code and no CISA KEV listing have been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL. All currently supported AEM deployment models are affected - Cloud Service through 2026.7.0, on-premises 6.5 through 6.5.24, and 6.5 LTS through SP2. The scope change in the CVSS vector indicates the JavaScript executes in a context beyond the vulnerable component itself, potentially enabling session hijacking or privilege escalation within the AEM environment. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

DOM-based XSS in Adobe Experience Manager enables an authenticated attacker to inject malicious JavaScript that executes within a victim's browser by manipulating client-side DOM sinks on crafted or attacker-influenced AEM pages. Affected deployments span AEM 6.5 on-premises through version 6.5.24, the 6.5 LTS track through SP2, and AEM as a Cloud Service through the 2026.7.0 release channel. Adobe has addressed the issue in advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-adjacent, low-privileged attacker to execute arbitrary JavaScript within a victim's browser session by luring them to a crafted webpage. The vulnerability arises from unsanitized attacker-controlled data being written into the DOM without server-side involvement, enabling script execution in a changed security scope (S:C). Exploitation requires user interaction and no public exploit or CISA KEV listing has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables an authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating client-side DOM sources and sinks via a crafted webpage. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 (≤6.5.24), and AEM 6.5 LTS (≤SP2), as confirmed by Adobe APSB26-98. The CVSS scope-change metric (S:C) indicates the payload escapes the AEM application context and can affect the victim's broader browser environment; no public exploit identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to execute arbitrary JavaScript in a victim's browser session by inducing that authenticated user to visit a crafted webpage. Affected versions span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The CVSS scope-change indicator (S:C) reflects that injected scripts execute within the victim's browser context, potentially enabling session theft, credential harvesting, or actions performed on behalf of the victim beyond the AEM application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by luring the victim to a crafted webpage. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The scope-changed impact means the malicious script executes outside the originating application boundary, enabling session hijacking, credential theft, or UI redressing against authenticated AEM users. No public exploit or CISA KEV listing has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser session by delivering a crafted URL that manipulates the client-side DOM environment. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. The CVSS scope change (S:C) indicates the injected script executes in a different browser security context than the attacker's origin, enabling cross-context session abuse. No public exploit or CISA KEV listing is present at time of analysis.

DOM-based XSS in Adobe Experience Manager allows authenticated low-privileged attackers to inject malicious JavaScript into a victim's browser by luring them to a specially crafted URL that manipulates the client-side DOM without server-side involvement. Affected versions include AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has issued a fix under advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser by enticing them to visit a crafted URL or page, with scope change enabling cross-context impact. Affected versions include AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0, all addressed under Adobe Security Bulletin APSB26-98. No public exploit code or active exploitation has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to inject malicious JavaScript into a victim's browser by manipulating the DOM environment through a crafted webpage. Affected deployments span AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit has been identified at time of analysis; Adobe has published security bulletin APSB26-98 addressing this issue.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL or page that exploits client-side DOM processing. Affected are AEM 6.5 LTS through SP2, AEM 6.5 on-premise through 6.5.24, and AEM as a Cloud Service through the 2026.7.0 release. Successful exploitation enables session hijacking, credential theft, or unauthorized actions performed within the AEM environment on behalf of the victim, with scope change indicating impact crosses from the web application into the victim's browser context.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute arbitrary JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. The scope-changed CVSS vector (S:C) confirms the malicious script executes in the victim's browser security context rather than the server, enabling session hijacking, credential theft, or UI redress against AEM users. Reported directly by Adobe PSIRT and addressed in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged attacker to manipulate client-side DOM variables to inject and execute arbitrary JavaScript within a victim's browser session. Affected are AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, per Adobe advisory APSB26-98. The scope change in the CVSS vector indicates that injected scripts can reach browser resources outside the AEM application origin, enabling session hijacking or cross-application data theft when a victim clicks a crafted link.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a network-accessible, low-privileged attacker to inject malicious JavaScript that executes entirely within a victim's browser session by manipulating the DOM environment. Affected versions span the AEM 6.5 branch (≤6.5.24), the 6.5 LTS edition (≤SP2), and AEM as a Cloud Service (≤2026.7.0), covering a broad enterprise install base. The CVSS vector confirms a scope change (S:C), meaning successful exploitation can affect browser resources beyond the originating AEM page - such as session tokens or cross-frame content - though user interaction via a crafted webpage visit is required for the attack to succeed.

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables authenticated attackers with low-level access to inject malicious JavaScript into victim browsers, achieving a scope change that allows cross-origin script execution. Affected versions span AEM as a Cloud Service ≤2026.7.0, AEM 6.5 LTS ≤SP2, and AEM 6.5 ≤6.5.24, as confirmed by Adobe advisory APSB26-98. Exploitation requires user interaction; no public exploit or CISA KEV listing has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes inside a victim's browser when the victim visits a specially crafted URL or page hosted within the AEM environment. Affects AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. No public exploit identified at time of analysis; Adobe has released patches via advisory APSB26-98.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by directing the victim to a crafted webpage that manipulates the AEM client-side DOM environment. Affected releases span AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. The scope-changed impact means the injected script operates outside AEM's own origin boundary, enabling session theft or unauthorized actions against the authenticated victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) allows a low-privileged attacker to execute arbitrary JavaScript within a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected versions span AEM as a Cloud Service through 2026.7.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. The vulnerability carries a scope-change flag (S:C), indicating the injected script can affect browser context beyond AEM's own page, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.

DOM-based XSS in Adobe Experience Manager allows a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment through a crafted webpage. Affected are AEM 6.5 LTS through SP2, AEM 6.5 through 6.5.24, and AEM as a Cloud Service through 2026.7.0. No public exploit or KEV listing has been identified at time of analysis; exploitation requires both attacker authentication (PR:L) and victim interaction with a crafted URL or page.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser by enticing them to visit a specially crafted URL. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the July 2026 (2026.7.0) release, with Adobe addressing this in security bulletin APSB26-98. The CVSS scope-change metric (S:C) reflects that successful exploitation crosses the AEM application boundary into the victim's browser context, enabling session hijacking, credential theft, or forced authenticated actions - no public exploit code or CISA KEV listing has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers after social-engineering them into visiting a crafted webpage. Affected versions span AEM as a Cloud Service up to 2026.7.0, AEM 6.5 up to 6.5.24, and AEM 6.5 LTS up to SP2. The CVSS scope-change indicator (S:C) means injected scripts can reach browser contexts beyond the AEM origin, elevating potential impact to cross-origin session theft or privilege escalation within the CMS authoring environment. No public exploit or active exploitation has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2 enables authenticated low-privileged attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the Document Object Model client-side. The scope change (S:C in the CVSS vector) confirms that successful exploitation escapes AEM's own security boundary, allowing the injected script to access browser-resident resources such as cookies, localStorage, or cross-origin-accessible DOM of other open pages. Exploitation requires a victim with a valid AEM session to be social-engineered into visiting a crafted URL, making this a realistic privilege-escalation vector from author/editor to administrator in enterprise AEM deployments. No public exploit code or CISA KEV listing identified at time of analysis; vendor advisory APSB26-98 is available.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated remote attackers to execute arbitrary JavaScript in a victim's browser by manipulating the DOM environment of a crafted webpage the victim is induced to visit. Affected deployments span AEM 6.5 on-premises through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0. Adobe has released a remediation via advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the client-side DOM environment. Affected versions span the AEM 6.5 branch (through 6.5.24), AEM 6.5 LTS (through SP2), and AEM as a Cloud Service (through 2026.7.0). Exploitation requires the attacker to hold a low-privileged AEM account and socially engineer a target user into visiting a crafted URL; no public exploit or active exploitation has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within a victim's browser by manipulating the client-side DOM environment, achieving a scope change that can affect resources beyond the AEM origin. Affected deployments span AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), covering both cloud and on-premises enterprise installations. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires a victim to interact with a crafted webpage delivered by the attacker.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser by inducing them to visit a crafted URL that manipulates client-side DOM sinks. Affected deployments span AEM 6.5 on-premises through version 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release. The CVSS scope-change (S:C) indicates injected scripts execute outside the vulnerable component's security boundary, enabling session theft or privileged action execution within the AEM browser origin. No public exploit or active exploitation has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript in a victim's browser session by luring the victim to a crafted URL or webpage. Affected deployments span Adobe Experience Manager 6.5 (through 6.5.24), Experience Manager 6.5 LTS (through SP2), and the Experience Manager as a Cloud Service (through the 2026.7.0 release). The scope-change designation confirms the malicious script executes outside the AEM server context - in the victim's browser - enabling session token theft, credential harvesting, or unauthorized AEM actions on behalf of the victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager (AEM) enables a low-privileged authenticated attacker to inject malicious JavaScript into a victim's browser by manipulating client-side DOM sources before they reach execution sinks. Affected versions span AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through the 2026.7.0 release; Adobe has addressed this through security advisory APSB26-98. The CVSS scope-change flag (S:C) reflects that successful exploitation crosses the boundary from the vulnerable AEM application into the victim's browser context, enabling session hijacking or unauthorized content manipulation on behalf of higher-privileged users.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated, low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM sources. Affected deployments span AEM as a Cloud Service through 2026.7.0, AEM 6.5 LTS through SP2, and AEM 6.5 through 6.5.24. The CVSS scope-change designation (S:C) indicates injected script can reach browser context beyond the AEM application boundary; no public exploit has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged authenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by directing them to a crafted URL, with scope change enabling cross-context impact beyond the AEM application itself. Affected deployments span AEM 6.5 LTS up to SP2, AEM 6.5 up to version 6.5.24, and AEM as a Cloud Service up to the 2026.7.0 release. No public exploit code or active exploitation has been confirmed at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to inject and execute malicious JavaScript in a victim's browser by luring them to a crafted webpage that manipulates the client-side DOM environment. Affected are AEM as a Cloud Service (≤2026.7.0), AEM 6.5 LTS (≤SP2), and AEM 6.5 (≤6.5.24), per Adobe advisory APSB26-98. The scope-change designation (S:C) indicates injected scripts can reach browser resources beyond AEM's own application boundary, enabling session theft or cross-origin actions. No public exploit or CISA KEV listing is present at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privileged attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that manipulates client-side DOM processing. Affected versions include AEM 6.5 through 6.5.24, AEM as a Cloud Service through 2026.7.0, and AEM 6.5 LTS through SP2. Exploitation requires user interaction (victim must visit the crafted page), and the scope change in the CVSS vector (S:C) confirms the attack can affect resources beyond the immediate AEM application context. No public exploit or CISA KEV listing has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated low-privilege attacker to execute arbitrary JavaScript within a victim's browser session after tricking that user into visiting a crafted page. The vulnerability spans AEM as a Cloud Service (≤2026.7.0), AEM 6.5 on-premises (≤6.5.24), and AEM 6.5 LTS (≤SP2), covering all major supported deployment tracks. Adobe has released remediation via Security Bulletin APSB26-98; no confirmed active exploitation or public exploit code is recorded at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager enables a low-privileged attacker to inject and execute arbitrary JavaScript within a victim's browser session by manipulating the DOM environment through a crafted webpage. The vulnerability affects AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, with scope change indicating the malicious script can reach beyond AEM's own security context into the victim's broader browser environment. Adobe has addressed this in advisory APSB26-98; no public exploit code or active exploitation has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject malicious JavaScript that executes within a victim's browser session by manipulating the DOM environment client-side. Affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP2, and AEM as a Cloud Service through 2026.7.0, exploitation requires the victim to visit a specially crafted webpage, making social engineering a necessary step. Adobe has released APSB26-98 addressing all three product lines; no public exploit or active exploitation has been identified at time of analysis.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows low-privileged attackers to execute arbitrary JavaScript within a victim's browser by inducing them to visit a specially crafted AEM webpage, with the scope crossing the AEM origin boundary into the browser's security context. All three supported deployment tracks are affected: AEM as a Cloud Service through the 2026.7.0 release cycle, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP2. Adobe addressed this under advisory APSB26-98; no public exploit code or CISA KEV listing has been identified at time of analysis.