Listen to this Post
How the CVE Works
CVE-2025-46965 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which persists in the application database. When a victim accesses a page containing the compromised field, the script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions within the user’s context. The attack exploits insufficient input sanitization in AEM’s web form handlers, allowing arbitrary script execution without proper validation.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/10/2025
Prediction: Patch by 07/15/2025
What Undercode Say
Check AEM version curl -I http://<target>/system/console/status-Product-Info Exploit PoC (sanitized) POST /content/forms/af/injectable-field HTTP/1.1 Payload: <script>alert(document.cookie)</script> Mitigation test grep "XSS filters" /aem/install/dir/crx-quickstart/logs/error.log
How Exploit
1. Attacker submits malicious script via vulnerable form.
2. Script saves in AEM repository.
3. Victim loads page, script executes.
Protection from this CVE
- Update to AEM ≥ 6.5.23 (post-patch).
- Enable CSP headers.
- Sanitize user inputs server-side.
Impact
- Session hijacking.
- Unauthorized admin actions.
- Data exfiltration.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
