Listen to this Post
How the CVE Works
CVE-2025-47011 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. A low-privileged attacker can inject malicious JavaScript into vulnerable form fields, which persists in the system. When a victim accesses a page containing the compromised field, the script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions. The attack exploits insufficient input sanitization in AEM’s web form handlers, allowing arbitrary script embedding.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/16/2025
Prediction: Patch by 07/15/2025
What Undercode Say
Analytics:
curl -X GET "https://aem-instance/vuln-endpoint" -H "User-Agent: <script>alert(1)</script>"
import requests
payload = "<script>exploit()</script>"
requests.post("https://aem-form-submit", data={"field": payload})
How Exploit
1. Authenticate as low-privileged user.
2. Submit malicious script via vulnerable form.
3. Trigger execution via victim’s page load.
Protection from this CVE
- Upgrade to AEM 6.5.23+.
- Implement CSP headers.
- Sanitize form inputs server-side.
Impact
- Session hijacking.
- Data exfiltration.
- Unauthorized admin actions.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
