Listen to this Post
How CVE-2025-47006 Works
CVE-2025-47006 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers with low privileges can inject malicious JavaScript into vulnerable form fields, which persists in the application. When a victim accesses a page containing the compromised field, the script executes in their browser. The attack exploits insufficient input sanitization in AEM’s web forms, allowing arbitrary script injection. This can lead to session hijacking, data theft, or unauthorized actions under the victim’s context. The vulnerability is critical due to its potential for widespread exploitation with minimal user interaction.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/16/2025
Prediction: Patch by 07/15/2025
What Undercode Say
curl -X POST -d "input=<script>alert('XSS')</script>" http://vulnerable-aem-instance/form
document.write('<img src=x onerror=stealCookies()>');
How Exploit
1. Attacker submits malicious script via form.
2. Script stored in AEM database.
3. Victim loads page triggering execution.
Protection from this CVE
1. Update to AEM 6.5.23+.
2. Sanitize form inputs.
3. Implement CSP headers.
Impact
1. Session hijacking.
2. Data theft.
3. Unauthorized actions.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
