CVE-2025-47076
published 2025-06-10CVE-2025-47076: Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged…
PriorityP428medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.27%
19.3th percentile
Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | adobe_experience_manager | <= 6.5.22 | — |
| adobe | experience_manager | < 6.5.23.0 | 6.5.23.0 |
| adobe | experience_manager | < 2025.5.0 | 2025.5.0 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
ghsa6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host
ghsa·2026-06-26·CVSS 6.5
CVE-2026-47076 [MEDIUM] CWE-436 Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host
Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host
### Summary
`hackney_url:normalize/2` URL-decodes the host component of a parsed URL, but the caller's SSRF allowlist runs before normalization using OTP's `uri_string:parse/1` and `inet:parse_address/1`, neither of which decodes percent-escapes in hostnames. A URL like `http://%31%32%37%2E%30%2E%30%2E%31/` presents an encoded, non-IP-looking host to the validator, which passes the allowlist check; hackney's normalizer then decodes it to `127.0.0.1` and connects to loopback. Because `hackney:request/5` always calls `normalize/2` with no opt-out, every request path that accepts a binary or list URL is affected. This is a parser-differential SSRF in the same class as CVE-2025-1211, but in a different func
GHSA
GHSA-6x92-f35w-3985: Adobe Experience Manager versions 6
ghsa_unreviewed·2025-06-11
CVE-2025-47076 [MEDIUM] CWE-79 GHSA-6x92-f35w-3985: Adobe Experience Manager versions 6
Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-06-10
Published