Adobe Experience Manager vulnerabilities

CVE-2026-27242 [MEDIUM] CWE-79 CVE-2026-27242: Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting ( Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

CVE-2018-4876 [MEDIUM] CWE-79 CVE-2018-4876: Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a byp Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPI#getValidHref function.

CVE-2018-12807 [MEDIUM] CWE-20 CVE-2018-12807: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have an input validation bypass vulner Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have an input validation bypass vulnerability. Successful exploitation could lead to unauthorized information modification.

CVE-2019-8080 [MEDIUM] CWE-79 CVE-2019-8080: Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Succ Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.

CVE-2023-48441 [MEDIUM] CWE-284 CVE-2023-48441: Adobe Experience Manager versions 6.5.18 and earlier are affected by an Improper Access Control vuln Adobe Experience Manager versions 6.5.18 and earlier are affected by an Improper Access Control vulnerability. An attacker could leverage this vulnerability to achieve a low-confidentiality impact within the application. Exploitation of this issue does not require user interaction.

CVE-2022-30683 [MEDIUM] CWE-657 CVE-2022-30683: Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a Violation of Secure Design Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a Violation of Secure Design Principles vulnerability that could lead to bypass the security feature of the encryption mechanism in the backend . An attacker could leverage this vulnerability to decrypt secrets, however, this is a high-complexity attack as the threat actor needs

CVE-2026-75738 [MEDIUM] CWE-79 CVE-2026-75738: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-75741 [MEDIUM] CWE-79 CVE-2026-75741: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-75736 [MEDIUM] CWE-79 CVE-2026-75736: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-75740 [MEDIUM] CWE-79 CVE-2026-75740: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-75729 [MEDIUM] CWE-79 CVE-2026-75729: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-75735 [MEDIUM] CWE-79 CVE-2026-75735: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-79905 [MEDIUM] CWE-79 CVE-2026-79905: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-27227 [MEDIUM] CWE-79 CVE-2026-27227: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-75642 [MEDIUM] CWE-79 CVE-2026-75642: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-71440 [MEDIUM] CWE-79 CVE-2026-71440: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-75644 [MEDIUM] CWE-79 CVE-2026-75644: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-75731 [MEDIUM] CWE-79 CVE-2026-75731: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-75734 [MEDIUM] CWE-79 CVE-2026-75734: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2026-75739 [MEDIUM] CWE-79 CVE-2026-75739: Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.