CVE-2026-34694mediumCWE-79

CVE-2026-34694: falha de média gravidade em Adobe Experience Manager 6.5

Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Adobe Experience Manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.8epss 0.2%
Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Adobe · Adobe Experience Manager 6.5Adobe · Adobe Experience Manager 6.5 LTS
CVEs relacionadas — Adobe Experience Manager 6.5

No mesmo produto, das mais perigosas para as menos.

CVE-2026-103848CRITICALAdobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 1.4%CVE-2026-90531CRITICALAdobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 1.4%CVE-2026-48310HIGHAdobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 1.0%CVE-2026-83662CRITICALAdobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)EPSS 1.0%CVE-2026-19232CRITICALAdobe Experience Manager | Incorrect Authorization (CWE-863)EPSS 1.0%CVE-2026-48359CRITICALAdobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 1.0%