Listen to this Post
How the CVE Works
CVE-2025-46963 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers with low privileges can inject malicious JavaScript into vulnerable form fields, which persists in the application. When a victim accesses a compromised page, the script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions. The flaw arises from insufficient input sanitization in form submissions, allowing arbitrary script embedding.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/10/2025
Prediction: Patch by 07/15/2025
What Undercode Say
Check AEM version curl -I http://<target>/system/console/version Exploit PoC (sanitized) POST /content/forms/af/injectable-field HTTP/1.1 Host: <target> Payload: <script>alert(document.cookie)</script>
How Exploit
1. Attacker submits malicious script via vulnerable form.
2. Script saves to AEM database.
3. Victim loads page, script executes.
Protection from this CVE
- Update to AEM 6.5.23+.
- Sanitize form inputs.
- Apply CSP headers.
Impact
- Session hijacking.
- Data exfiltration.
- Unauthorized admin actions.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
