Listen to this Post
How the CVE Works
CVE-2025-47044 affects Adobe Experience Manager (AEM) versions 6.5.22 and earlier. The vulnerability arises due to insufficient input sanitization in certain form fields, allowing a low-privileged attacker to inject malicious JavaScript. When a victim accesses a compromised page, the script executes in their browser, potentially leading to session hijacking, data theft, or unauthorized actions within the application. The attack is stored, meaning the payload persists on the server until manually removed.
DailyCVE Form
Platform: Adobe Experience Manager
Version: ≤ 6.5.22
Vulnerability: Stored XSS
Severity: Critical
Date: 06/16/2025
Prediction: Patch expected by 07/15/2025
What Undercode Say
Analytics:
curl -X GET "https://api.adobe.com/aem/checkvuln?version=6.5.22" grep -r "unsafeHTML" /var/www/aem/components/
Exploit:
<form action="/content/forms/xss" method="POST"> <input type="text" name="payload" value="<script>alert(document.cookie)</script>"> </form>
Protection from this CVE:
- Update to AEM 6.5.23+
- Sanitize user inputs using OWASP ESAPI
- Implement Content Security Policy (CSP) headers
Impact:
- Session hijacking
- Data exfiltration
- Unauthorized admin actions
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
