# Adobe Experience Manager.

Every CVE that names Adobe Experience Manager among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [AEM Reflected XSS Arbitrary code execution](https://agentprime.io/advisories/CVE-2022-30677.md)
  `CVE-2022-30677` · CVE record: Adobe Experience Manager · CVSS 5.4 Medium · Not analysed yet · Published 16 Sept 2022 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager Stored XSS in the Spin Set](https://agentprime.io/advisories/CVE-2021-43764.md)
  `CVE-2021-43764` · CVE record: Adobe Experience Manager · CVSS 8.0 High · Not analysed yet · Published 13 Jan 2022 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager Stored XSS in workflow Stages parameter](https://agentprime.io/advisories/CVE-2021-44176.md)
  `CVE-2021-44176` · CVE record: Adobe Experience Manager · CVSS 8.1 High · Not analysed yet · Published 13 Jan 2022 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager Stored XSS on Edit Tag page via Localization input](https://agentprime.io/advisories/CVE-2021-43761.md)
  `CVE-2021-43761` · CVE record: Adobe Experience Manager · CVSS 8.0 High · Not analysed yet · Published 13 Jan 2022 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager Stored XSS in user name parameter in the package manager](https://agentprime.io/advisories/CVE-2021-44177.md)
  `CVE-2021-44177` · CVE record: Adobe Experience Manager · CVSS 8.1 High · Not analysed yet · Published 13 Jan 2022 · Tags: Cross-site scripting (XSS)
- [AEM Forms Improper Restriction of XML External Entity Reference](https://agentprime.io/advisories/CVE-2021-40722.md)
  `CVE-2021-40722` · CVE record: Adobe Experience Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jan 2022 · Tags: XML external entities (XXE)
- [Adobe Experience Manager Stored XSS in the Carousel Set](https://agentprime.io/advisories/CVE-2021-43765.md)
  `CVE-2021-43765` · CVE record: Adobe Experience Manager · CVSS 8.1 High · Not analysed yet · Published 13 Jan 2022 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager Reflected XSS in /bin/wcm/contentfinder/page/view.html](https://agentprime.io/advisories/CVE-2021-44178.md)
  `CVE-2021-44178` · CVE record: Adobe Experience Manager · CVSS 5.4 Medium · Not analysed yet · Published 13 Jan 2022 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager Unicode normalization leads to dispatcher bypass](https://agentprime.io/advisories/CVE-2021-43762.md)
  `CVE-2021-43762` · CVE record: Adobe Experience Manager · CVSS 6.5 Medium · Not analysed yet · Published 13 Jan 2022 · Tags: CWE-20
- [Adobe Experience Manager Path parameter Improper Input Validation Could Lead To DOS](https://agentprime.io/advisories/CVE-2021-40712.md)
  `CVE-2021-40712` · CVE record: Adobe Experience Manager · CVSS 6.5 Medium · Not analysed yet · Published 27 Sept 2021 · Tags: CWE-20
- [Adobe Experience Manager Reflected Cross Site Scripting via accesskey parameter](https://agentprime.io/advisories/CVE-2021-40714.md)
  `CVE-2021-40714` · CVE record: Adobe Experience Manager · CVSS 6.1 Medium · Not analysed yet · Published 27 Sept 2021 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager Improper Certificate Validation Could Lead to Man In The Middle Attack](https://agentprime.io/advisories/CVE-2021-40713.md)
  `CVE-2021-40713` · CVE record: Adobe Experience Manager · CVSS 5.9 Medium · Not analysed yet · Published 27 Sept 2021 · Tags: Weak cryptography or TLS
- [Adobe Experience Manager Stored Cross-Site Scripting Could Lead to Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2021-40711.md)
  `CVE-2021-40711` · CVE record: Adobe Experience Manager · CVSS 5.4 Medium · Not analysed yet · Published 27 Sept 2021 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager Server-side Request Forgery could lead to Security feature bypass](https://agentprime.io/advisories/CVE-2021-28627.md)
  `CVE-2021-28627` · CVE record: Adobe Experience Manager · CVSS 5.4 Medium · Not analysed yet · Published 24 Aug 2021 · Tags: Server-side request forgery (SSRF)
- [Adobe Experience Manager Cross-site Scripting vulnerability in inbox render.jsp](https://agentprime.io/advisories/CVE-2021-28628.md)
  `CVE-2021-28628` · CVE record: Adobe Experience Manager · CVSS 6.3 Medium · Not analysed yet · Published 24 Aug 2021 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager Cross-site Scripting vulnerability in inbox workitem.jsp](https://agentprime.io/advisories/CVE-2021-28625.md)
  `CVE-2021-28625` · CVE record: Adobe Experience Manager · CVSS 6.3 Medium · Not analysed yet · Published 24 Aug 2021 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager Improper Authorization at /content/usergenerated](https://agentprime.io/advisories/CVE-2021-28626.md)
  `CVE-2021-28626` · CVE record: Adobe Experience Manager · CVSS 3.7 Low · Not analysed yet · Published 24 Aug 2021 · Tags: Broken access control
- [Adobe Experience Manager stored cross-site scripting vulnerability in resource resolver factory could lead to arbitrary code execution](https://agentprime.io/advisories/CVE-2021-21084.md)
  `CVE-2021-21084` · CVE record: Adobe Experience Manager · CVSS 7.3 High · Not analysed yet · Published 28 Jun 2021 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager broken access control in DSRPReindexServlet could lead to denial-of-service](https://agentprime.io/advisories/CVE-2021-21083.md)
  `CVE-2021-21083` · CVE record: Adobe Experience Manager · CVSS 7.5 High · Not analysed yet · Published 28 Jun 2021 · Tags: Broken access control
- [Blind SSRF in Forms add-on for AEM](https://agentprime.io/advisories/CVE-2020-24444.md)
  `CVE-2020-24444` · CVE record: Adobe Experience Manager · CVSS 5.8 Medium · Not analysed yet · Published 10 Dec 2020 · Tags: Server-side request forgery (SSRF)
- [HTML injection in AEM's content editor component](https://agentprime.io/advisories/CVE-2020-9743.md)
  `CVE-2020-9743` · CVE record: Adobe Experience Manager · CVSS 5.3 Medium · Not analysed yet · Published 10 Sept 2020 · Tags: CWE-20
- [Stored XSS in AEM Forms component](https://agentprime.io/advisories/CVE-2020-9734.md)
  `CVE-2020-9734` · CVE record: Adobe Experience Manager · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2020 · Tags: Cross-site scripting (XSS)
- [Reflected XSS in AEM Inbox module](https://agentprime.io/advisories/CVE-2020-9742.md)
  `CVE-2020-9742` · CVE record: Adobe Experience Manager · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2020 · Tags: Cross-site scripting (XSS)
- [Stored XSS in AEM Forms Components](https://agentprime.io/advisories/CVE-2020-9741.md)
  `CVE-2020-9741` · CVE record: Adobe Experience Manager · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2020 · Tags: Cross-site scripting (XSS)
- [Stored XSS in AEM's Content Repository Development Environment](https://agentprime.io/advisories/CVE-2020-9736.md)
  `CVE-2020-9736` · CVE record: Adobe Experience Manager · CVSS 6.8 Medium · Not analysed yet · Published 10 Sept 2020 · Tags: Cross-site scripting (XSS)
- [Stored XSS in AEM's Content Repository Development Environment](https://agentprime.io/advisories/CVE-2020-9735.md)
  `CVE-2020-9735` · CVE record: Adobe Experience Manager · CVSS 6.8 Medium · Not analysed yet · Published 10 Sept 2020 · Tags: Cross-site scripting (XSS)
- [Stored XSS in AEM Sites Components](https://agentprime.io/advisories/CVE-2020-9732.md)
  `CVE-2020-9732` · CVE record: Adobe Experience Manager · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2020 · Tags: Cross-site scripting (XSS)
- [Stored XSS in AEM's Content Repository Development Environment](https://agentprime.io/advisories/CVE-2020-9738.md)
  `CVE-2020-9738` · CVE record: Adobe Experience Manager · CVSS 6.8 Medium · Not analysed yet · Published 10 Sept 2020 · Tags: Cross-site scripting (XSS)
- [Stored XSS in AEM's Content Repository Development Environment](https://agentprime.io/advisories/CVE-2020-9737.md)
  `CVE-2020-9737` · CVE record: Adobe Experience Manager · CVSS 6.8 Medium · Not analysed yet · Published 10 Sept 2020 · Tags: Cross-site scripting (XSS)
- [Sensitive information disclosure possible in AEM](https://agentprime.io/advisories/CVE-2020-9733.md)
  `CVE-2020-9733` · CVE record: Adobe Experience Manager · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2020 · Tags: Information disclosure
- [Stored XSS in AEM Design Importer Component](https://agentprime.io/advisories/CVE-2020-9740.md)
  `CVE-2020-9740` · CVE record: Adobe Experience Manager · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2020 · Tags: Cross-site scripting (XSS)
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected)…](https://agentprime.io/advisories/CVE-2020-9651.md)
  `CVE-2020-9651` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 12 Jun 2020
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based)…](https://agentprime.io/advisories/CVE-2020-9647.md)
  `CVE-2020-9647` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 12 Jun 2020
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (stored)…](https://agentprime.io/advisories/CVE-2020-9644.md)
  `CVE-2020-9644` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 12 Jun 2020
- [Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting vulnerability.](https://agentprime.io/advisories/CVE-2020-9648.md)
  `CVE-2020-9648` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 12 Jun 2020
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery…](https://agentprime.io/advisories/CVE-2020-9643.md)
  `CVE-2020-9643` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 12 Jun 2020
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5 and earlier have a blind server-side request…](https://agentprime.io/advisories/CVE-2020-9645.md)
  `CVE-2020-9645` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 12 Jun 2020
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5 and earlier have a server-side request forgery…](https://agentprime.io/advisories/CVE-2020-3769.md)
  `CVE-2020-3769` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 25 Mar 2020
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5…](https://agentprime.io/advisories/CVE-2020-3741.md)
  `CVE-2020-3741` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 13 Feb 2020
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1…](https://agentprime.io/advisories/CVE-2019-16467.md)
  `CVE-2019-16467` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 15 Jan 2020
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1…](https://agentprime.io/advisories/CVE-2019-16468.md)
  `CVE-2019-16468` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 15 Jan 2020
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1…](https://agentprime.io/advisories/CVE-2019-16469.md)
  `CVE-2019-16469` · CVE record: Adobe Adobe Experience Manager · No CVSS score · EPSS 0.17 · Not analysed yet · Published 15 Jan 2020
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1…](https://agentprime.io/advisories/CVE-2019-16466.md)
  `CVE-2019-16466` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 15 Jan 2020
- [Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a cross-site request forgery vulnerability.](https://agentprime.io/advisories/CVE-2019-8234.md)
  `CVE-2019-8234` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 25 Oct 2019
- [Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability.](https://agentprime.io/advisories/CVE-2019-8088.md)
  `CVE-2019-8088` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 25 Oct 2019
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5, 6.4…](https://agentprime.io/advisories/CVE-2019-8087.md)
  `CVE-2019-8087` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 25 Oct 2019
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5, 6.4…](https://agentprime.io/advisories/CVE-2019-8086.md)
  `CVE-2019-8086` · CVE record: Adobe Adobe Experience Manager · No CVSS score · EPSS 0.23 · Not analysed yet · Published 25 Oct 2019
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5, 6.4…](https://agentprime.io/advisories/CVE-2019-8085.md)
  `CVE-2019-8085` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 25 Oct 2019
- [Adobe Experience Manager: Adobe Experience Manager versions 6.5, 6.4…](https://agentprime.io/advisories/CVE-2019-8084.md)
  `CVE-2019-8084` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 25 Oct 2019
- [Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability.](https://agentprime.io/advisories/CVE-2019-8083.md)
  `CVE-2019-8083` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 25 Oct 2019
- [Adobe Experience Manager: Adobe Experience Manager versions 6.4…](https://agentprime.io/advisories/CVE-2019-8082.md)
  `CVE-2019-8082` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 25 Oct 2019
- [Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have an authentication bypass vulnerability.](https://agentprime.io/advisories/CVE-2019-8081.md)
  `CVE-2019-8081` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 25 Oct 2019
- [Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability.](https://agentprime.io/advisories/CVE-2019-8080.md)
  `CVE-2019-8080` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 24 Oct 2019
- [Adobe Experience Manager: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1…](https://agentprime.io/advisories/CVE-2019-8079.md)
  `CVE-2019-8079` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 24 Oct 2019
- [Adobe Experience Manager: Adobe Experience Manager versions 6.4…](https://agentprime.io/advisories/CVE-2019-8078.md)
  `CVE-2019-8078` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 24 Oct 2019
- [Adobe Experience Manager versions 6.5, and 6.4 have an authentication bypass vulnerability.](https://agentprime.io/advisories/CVE-2019-7964.md)
  `CVE-2019-7964` · CVE record: Adobe Adobe Experience Manager · No CVSS score · EPSS 0.10 · Not analysed yet · Published 16 Aug 2019
- [Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability.](https://agentprime.io/advisories/CVE-2019-7953.md)
  `CVE-2019-7953` · CVE record: Adobe Experience Manager · No CVSS score · Not analysed yet · Published 18 Jul 2019
- [Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability.](https://agentprime.io/advisories/CVE-2019-7954.md)
  `CVE-2019-7954` · CVE record: Adobe Experience Manager · No CVSS score · Not analysed yet · Published 18 Jul 2019
- [Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability.](https://agentprime.io/advisories/CVE-2019-7955.md)
  `CVE-2019-7955` · CVE record: Adobe Experience Manager · No CVSS score · Not analysed yet · Published 18 Jul 2019
- [Adobe Experience Manager: Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1…](https://agentprime.io/advisories/CVE-2018-19727.md)
  `CVE-2018-19727` · CVE record: Adobe Adobe Experience Manager · No CVSS score · Not analysed yet · Published 28 Jan 2019

Newest: <https://agentprime.io/advisories/technology/adobe-experience-manager.md>
Older: <https://agentprime.io/advisories/technology/adobe-experience-manager.md?cursor=WyIyMDE5LTAxLTI4VDE4OjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxOC0xOTcyNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=adobe-experience-manager&cursor=WyIyMDIyLTA5LTE2VDE3OjQ1OjIwLjgyNDAwMFoiLCJDVkUtMjAyMi0zMDY4MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/adobe-experience-manager/?cursor=WyIyMDIyLTA5LTE2VDE3OjQ1OjIwLjgyNDAwMFoiLCJDVkUtMjAyMi0zMDY4MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.