Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victims browser when they browse to the page containing the vulnerable field.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2026-27224 |
Exploitation
An attacker can exploit this vulnerability by crafting a malicious script and injecting it into a vulnerable form field. When a victim accesses the page containing the compromised field, the malicious script executes in their browser, potentially leading to unauthorized actions or data theft.
Affected Products
- Adobe Experience Manager 6.5.23 and earlier: Vulnerable to stored XSS attacks through form fields.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Experience Manager that addresses the XSS issue. Additionally, implementing input validation and sanitization for form fields can help prevent script injection.