Listen to this Post
How CVE-2025-47040 Works
Adobe Experience Manager (AEM) versions 6.5.22 and earlier suffer from a stored XSS vulnerability in form fields. A low-privileged attacker can inject malicious JavaScript into vulnerable input fields, which persists in the system. When a victim accesses a page containing the compromised field, the script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions within the victim’s AEM context. The attack requires no user interaction beyond viewing the manipulated content.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/16/2025
Prediction: Patch expected by 07/15/2025
What Undercode Say
Check AEM version curl -I http://target/aem/version Exploit PoC (simulated) <script>alert(document.cookie)</script> Mitigation test grep -r "allowUnsafeHTML" /aem/install/path
How Exploit
1. Attacker submits malicious script via vulnerable form.
2. Script stored in AEM database.
3. Victim loads page, script executes.
Protection from this CVE
- Update to AEM 6.5.23+.
- Sanitize form inputs.
- Disable unsafe HTML rendering.
Impact
- Session hijacking.
- Data exfiltration.
- Unauthorized admin actions.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
