Adobe Experience Manager vulnerabilities
1,165 known vulnerabilities affecting adobe/experience_manager.
Total CVEs
1,165
CISA KEV
0
Public exploits
7
Exploited in wild
3
Severity breakdown
CRITICAL14HIGH30MEDIUM1111LOW10
Vulnerabilities
Page 43 of 59
CVE-2021-21043P4MEDIUMCVSS 6.1≥ unspecified, ≤ 4.9.22021-02-02
CVE-2021-21043 [MEDIUM] CWE-79 CVE-2021-21043: ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerab
ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within th
nvd
CVE-2016-7882P4MEDIUMCVSS 6.1≤ 6.2.02016-12-15
CVE-2016-7882 [MEDIUM] CWE-79 CVE-2016-7882: Adobe Experience Manager versions 6.2 and earlier have an input validation issue in the WCMDebug fil
Adobe Experience Manager versions 6.2 and earlier have an input validation issue in the WCMDebug filter that could be used in cross-site scripting attacks.
nvd
CVE-2016-7883P4MEDIUMCVSS 6.1v6.2.02016-12-15
CVE-2016-7883 [MEDIUM] CWE-79 CVE-2016-7883: Adobe Experience Manager version 6.2 has an input validation issue in create Launch wizard that coul
Adobe Experience Manager version 6.2 has an input validation issue in create Launch wizard that could be used in cross-site scripting attacks.
nvd
CVE-2016-7884P4MEDIUMCVSS 6.1≤ 6.1.02016-12-15
CVE-2016-7884 [MEDIUM] CWE-79 CVE-2016-7884: Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create a
Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks.
nvd
CVE-2020-9647P4MEDIUMCVSS 6.1≥ 6.4, < 6.4.8.1≥ 6.5, < 6.5.5.02020-06-12
CVE-2020-9647 [MEDIUM] CWE-79 CVE-2020-9647: Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based) vulnerabil
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based) vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser.
nvd
CVE-2018-15972P4MEDIUMCVSS 6.1v6.0.0v6.1.0+3 more2018-10-17
CVE-2018-15972 [MEDIUM] CWE-79 CVE-2018-15972: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vul
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
nvd
CVE-2018-15973P4MEDIUMCVSS 6.1v6.0.0v6.1.0+3 more2018-10-17
CVE-2018-15973 [MEDIUM] CWE-79 CVE-2018-15973: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vul
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
nvd
CVE-2018-4929P4MEDIUMCVSS 6.1≤ 6.2.02018-05-19
CVE-2018-4929 [MEDIUM] CWE-79 CVE-2018-4929: Adobe Experience Manager versions 6.2 and earlier have an exploitable stored cross-site scripting vu
Adobe Experience Manager versions 6.2 and earlier have an exploitable stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
nvd
CVE-2018-4931P4MEDIUMCVSS 6.1≤ 6.1.02018-05-19
CVE-2018-4931 [MEDIUM] CWE-79 CVE-2018-4931: Adobe Experience Manager versions 6.1 and earlier have an exploitable stored cross-site scripting vu
Adobe Experience Manager versions 6.1 and earlier have an exploitable stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
nvd
CVE-2016-6933P4MEDIUMCVSS 6.1v6.0.0v6.1.0+1 more2016-12-15
CVE-2016-6933 [MEDIUM] CWE-79 CVE-2016-6933: Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an
Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the AACComponent that could be used in cross-site scripting attacks.
nvd
CVE-2018-19726P4MEDIUMCVSS 6.1v6.0.0v6.1.0+3 more2019-01-28
CVE-2018-19726 [MEDIUM] CWE-79 CVE-2018-19726: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vul
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
nvd
CVE-2018-19724P4MEDIUMCVSS 6.1v6.2.0v6.3.0+1 more2019-01-28
CVE-2018-19724 [MEDIUM] CWE-79 CVE-2018-19724: Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerab
Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
nvd
CVE-2018-15969P4MEDIUMCVSS 6.1v6.3.0v6.4.02018-10-17
CVE-2018-15969 [MEDIUM] CWE-79 CVE-2018-15969: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vul
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
nvd
CVE-2019-7954P4MEDIUMCVSS 6.1≥ 6.2, ≤ 6.52019-07-18
CVE-2019-7954 [MEDIUM] CWE-79 CVE-2019-7954: Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. Su
Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.
nvd
CVE-2021-28628P4MEDIUMCVSS 6.1≤ 6.5.8.0≥ unspecified, ≤ 6.5.8.02021-08-24
CVE-2021-28628 [MEDIUM] CWE-79 CVE-2021-28628: Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected
Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerabl
nvd
CVE-2021-28625P4MEDIUMCVSS 6.1≤ 6.5.8.0≥ unspecified, ≤ 6.5.8.02021-08-24
CVE-2021-28625 [MEDIUM] CWE-79 CVE-2021-28625: Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected
Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerabl
nvd
CVE-2016-4169P4MEDIUMCVSS 5.3v6.0.0v6.1.0+1 more2016-08-09
CVE-2016-4169 [MEDIUM] CWE-200 CVE-2016-4169: Adobe Experience Manager 6.0, 6.1, and 6.2 allow attackers to obtain sensitive audit log event infor
Adobe Experience Manager 6.0, 6.1, and 6.2 allow attackers to obtain sensitive audit log event information via unspecified vectors.
nvd
CVE-2016-4253P4MEDIUMCVSS 5.3v5.6.1v6.0.0+2 more2016-08-09
CVE-2016-4253 [MEDIUM] CWE-200 CVE-2016-4253: The Backup functionality in Adobe Experience Manager 5.6.1, 6.0, 6.1, and 6.2 allows attackers to ob
The Backup functionality in Adobe Experience Manager 5.6.1, 6.0, 6.1, and 6.2 allows attackers to obtain sensitive information via unspecified vectors.
nvd
CVE-2024-36216P4MEDIUMCVSS 6.1fixed in 6.5.21fixed in 2024.52024-06-13
CVE-2024-36216 [MEDIUM] CWE-79 CVE-2024-36216: Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scriptin
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
nvd
CVE-2025-47049P4MEDIUMCVSS 6.1fixed in 6.5.23.0fixed in 2025.5.02025-06-10
CVE-2025-47049 [MEDIUM] CWE-79 CVE-2025-47049: Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scriptin
Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit
nvd