CVE-2026-47954: falha de média gravidade em Adobe Experience Manager 6.5
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.4%
probabilidade de exploração
0.4%top 68% das CVEs
exploração observada
nãonenhuma fonte reporta
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Adobe · Adobe Experience Manager 6.5Adobe · Adobe Experience Manager 6.5 LTSAdobe · Adobe Experience Manager as a Cloud ServiceCVEs relacionadas — Adobe Experience Manager 6.5
No mesmo produto, das mais perigosas para as menos.
CVE-2026-103848CRITICALAdobe Experience Manager | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)EPSS 1.4%CVE-2026-48310HIGHAdobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)EPSS 1.0%CVE-2026-48359CRITICALAdobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)EPSS 1.0%CVE-2026-48259CRITICALAdobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)EPSS 0.9%CVE-2026-48252HIGHAdobe Experience Manager | Missing Authentication for Critical Function (CWE-306)EPSS 0.9%CVE-2026-48383CRITICALAdobe Experience Manager | Incorrect Authorization (CWE-863)EPSS 0.8%