Adobe » Experience Manager Forms : Security Vulnerabilities, CVEs,
An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to sensitive data in an AEM repository.
Max CVSS
7.5
EPSS Score
0.28%
Published
2020-09-10
Updated
2021-09-14
The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Sites component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.
Max CVSS
9.0
EPSS Score
0.13%
Published
2020-09-10
Updated
2020-09-11
Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
Max CVSS
6.1
EPSS Score
0.10%
Published
2019-10-22
Updated
2019-10-23
Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
Max CVSS
6.1
EPSS Score
0.10%
Published
2019-05-29
Updated
2019-05-29
Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms.
Max CVSS
7.5
EPSS Score
0.28%
Published
2017-05-09
Updated
2017-07-08
Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks.
Max CVSS
6.1
EPSS Score
0.15%
Published
2016-12-15
Updated
2016-12-23
6 vulnerabilities found