Listen to this Post
How the CVE Works
CVE-2025-46960 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability arises due to insufficient input sanitization in form fields, allowing a low-privileged attacker to inject malicious JavaScript. When a victim accesses a compromised page, the script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions within the application. The attack leverages stored XSS, meaning the payload persists on the server and affects all users viewing the manipulated content.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/10/2025
Prediction: Patch by 07/15/2025
What Undercode Say
Check AEM version
curl -I http://target/aem/version
XSS payload example
<script>alert('CVE-2025-46960')</script>
Sanitization bypass test
"><img src=x onerror=alert(1)>
How Exploit
1. Attacker submits malicious script via vulnerable form.
2. Payload stored in AEM database.
3. Victim loads page, script executes.
Protection from this CVE
- Update to AEM 6.5.23+.
- Implement CSP headers.
- Sanitize user input server-side.
Impact
- Session hijacking.
- Data exfiltration.
- Unauthorized admin actions.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
