Product:
Adobe Experience Manager
Summary
Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim’s browser. Exploitation requires user interaction as a victim must visit a crafted webpage.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2026-34625 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious webpage that manipulates the DOM environment. When a victim visits this crafted webpage, the malicious JavaScript can execute within the victim’s browser context, potentially leading to unauthorized actions or data exposure.
Affected Products
- Adobe Experience Manager 6.5.24 and earlier: Affected by a DOM-based XSS vulnerability requiring user interaction.
- Adobe Experience Manager FP11.7 and earlier: Also vulnerable to the same XSS issue.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Experience Manager that addresses this issue. Additionally, users should avoid visiting untrusted websites and be cautious of links received from unknown sources.