VendorsAdobeexperience_managerany version

Vulnerabilities

Adobe Experience Manager any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

1222CVEs

Adobe Experience Manager | Incorrect Authorization (CWE-863)

Published 2026-09-08 · Analyzed

9.9EPSS 0.006

Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)

Published 2025-07-08 · Analyzed

9.8EPSS 0.529

Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability.

Published 2017-08-11 · Modified

9.8EPSS 0.086

AEM Forms Improper Restriction of XML External Entity Reference

Published 2022-01-13 · Modified

9.8EPSS 0.033

Adobe Experience Manager | Improper Access Control (CWE-284)

Published 2024-06-13 · Modified

9.8EPSS 0.009

Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

Published 2026-07-14 · Analyzed

9.6EPSS 0.010

Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)

Published 2026-07-14 · Analyzed

9.6EPSS 0.009

Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)

Published 2026-06-09 · Analyzed

9.3EPSS 0.007

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Published 2025-12-10 · Analyzed

9.3EPSS 0.007

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Published 2025-12-10 · Analyzed

9.3EPSS 0.006

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Published 2025-12-10 · Analyzed

9.3EPSS 0.005

Stored XSS in AEM Sites Components

Published 2020-09-10 · Modified

9.0EPSS 0.028

Cross-site Scripting Vulnerability in Commenting Function of Adobe Experience Manager (AEM)

Published 2020-12-10 · Modified

9.0EPSS 0.026

Stored XSS in AEM Forms component

Published 2020-09-10 · Modified

9.0EPSS 0.019

Stored XSS in AEM Forms Components

Published 2020-09-10 · Modified

9.0EPSS 0.019

Stored XSS in AEM Design Importer Component

Published 2020-09-10 · Modified

9.0EPSS 0.019

Reflected XSS in AEM Inbox module

Published 2020-09-10 · Modified

9.0EPSS 0.018

Adobe Experience Manager versions 6.2 and earlier have a vulnerability that could be used in Cross-Site Request Forgery attacks.

Published 2016-12-15 · Modified

8.8EPSS 0.034

Adobe Experience Manager Server-side Request Forgery could lead to Security feature bypass

Published 2021-08-24 · Modified

8.8EPSS 0.013

Adobe Experience Manager | Improper Authorization (CWE-285)

Published 2025-06-10 · Analyzed

8.7EPSS 0.004

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Published 2025-06-10 · Analyzed

8.7EPSS 0.004

Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Published 2026-07-14 · Analyzed

8.6EPSS 0.010

Adobe Experience Manager | Missing Authentication for Critical Function (CWE-306)

Published 2026-07-14 · Analyzed

8.6EPSS 0.009

Adobe Experience Manager Stored XSS in the Carousel Set

Published 2022-01-13 · Modified

8.1EPSS 0.016

Adobe Experience Manager Stored XSS in workflow Stages parameter

Published 2022-01-13 · Modified

8.1EPSS 0.016

Adobe Experience Manager Stored XSS in user name parameter in the package manager

Published 2022-01-13 · Modified

8.1EPSS 0.016

Adobe Experience Manager Stored XSS in the Spin Set

Published 2022-01-13 · Modified

8.0EPSS 0.015

Adobe Experience Manager Stored XSS on Edit Tag page via Localization input

Published 2022-01-13 · Modified

8.0EPSS 0.011

Adobe Experience Manager Forms JEE | Cross-site Scripting (Reflected XSS) (CWE-79)

Published 2026-06-09 · Analyzed

8.0EPSS 0.006

Adobe Experience Manager | Improper Input Validation (CWE-20)

Published 2025-09-09 · Analyzed

7.7EPSS 0.054

Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.

Published 2018-07-20 · Modified

7.5EPSS 0.533

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have an expression language injection vulnerability. Successful exploitation could lead to sensitive information disclosure.

Published 2020-01-15 · Modified

7.5EPSS 0.172

Adobe Experience Manager 6.3 and earlier has a misconfiguration vulnerability.

Published 2017-08-11 · Modified

7.5EPSS 0.068

Adobe Experience Manager 6.1 and earlier has a sensitive data exposure vulnerability.

Published 2017-08-11 · Modified

7.5EPSS 0.053

Adobe Experience Manager versions 6.4 and earlier have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.

Published 2018-07-20 · Modified

7.5EPSS 0.049

Adobe Experience Manager versions 6.2 and 6.3 have a Server-Side Request Forgery vulnerability. Successful exploitation could lead to sensitive information disclosure.

Published 2018-07-20 · Modified

7.5EPSS 0.042

Sensitive information disclosure possible in AEM

Published 2020-09-10 · Modified

7.5EPSS 0.038

Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

Published 2020-06-12 · Modified

7.5EPSS 0.033

Adobe Experience Manager versions 6.5 and earlier have a blind server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

Published 2020-06-12 · Modified

7.5EPSS 0.033

Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery (ssrf) vulnerability. Successful exploitation could lead to sensitive information disclosure.

Published 2020-03-25 · Modified

7.5EPSS 0.029