Listen to this Post
How the CVE Works
CVE-2025-47021 is a stored XSS vulnerability in Adobe Experience Manager (AEM) versions 6.5.22 and earlier. Attackers with low privileges can inject malicious JavaScript into vulnerable form fields, which persists in the database. When a victim accesses a page containing the compromised field, the script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions. The flaw arises due to insufficient input sanitization in form submissions, allowing arbitrary script execution within the application’s context.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/16/2025
Prediction: Patch expected by 07/15/2025
What Undercode Say
Analytics
Check AEM version curl -I http://<target>/system/console/status-productinfo Exploit PoC (sanitized) POST /content/forms/af/injectable-field HTTP/1.1 Payload: <script>alert(document.cookie)</script>
How Exploit
- Low-privileged users inject scripts via form fields.
- Malicious payloads execute when victims load the page.
- Bypasses sanitization checks in AEM’s form handlers.
Protection from this CVE
- Update to AEM 6.5.23+.
- Implement CSP headers.
- Sanitize user inputs server-side.
Impact
- Session hijacking.
- Data exfiltration.
- Unauthorized admin actions.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
