Login Request a demo
EM
Product
Experience Manager
by Adobe · last CVE Oct 13, 2026
1,272
CVEs
0
On KEV
9.9
Max CVSS
6
New 30D
Vulnerabilities1,272In the news0Timeline
Severity mix
Critical 19High 30Medium 451Low 0
Severity
All severities500Critical19High30Medium451Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Experience Manager to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-54247
6.5
0%
Sep 9
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass
Affected: through 6.5.23.0; through 2025.8.0; 6.5; 6.5
CVE-2025-54246
6.5
0%
Sep 9
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass
Affected: through 6.5.23.0; through 2025.8.0; 6.5; 6.5
CVE-2024-43729
6.5
1%
Dec 10
Adobe Experience Manager versions 6.5.21 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass
Affected: before 6.5.22.0; before 2024.11.0
CVE-2021-43762
6.5
2%
Jan 13
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a dispatcher bypass vulnerability that could be abused to evade security controls
Affected: through 6.5.10.0
CVE-2021-40712
6.5
2%
Sep 27
Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a improper input validation vulnerability via the path parameter
Affected: through 6.5.9.0
CVE-2019-8234
6.5
2%
Oct 25
Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a cross-site request forgery vulnerability
Affected: 6.2; 6.3; 6.4
CVE-2019-7953
6.5
3%
Jul 18
Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability
Affected: 6.0 through 6.4
CVE-2026-47991
6.1
0%
Jun 9
Adobe Experience Manager | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
Affected: before 6.5.25.0; before 2026.5.0; 6.5; 6.5
CVE-2025-47094
6.1
0%
Jun 10
Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability
Affected: before 6.5.23.0; before 2025.5.0
CVE-2025-47049
6.1
0%
Jun 10
Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability
Affected: before 6.5.23.0; before 2025.5.0
CVE-2024-36216
6.1
0%
Jun 13
Adobe Experience Manager versions 6.5.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability
Affected: before 6.5.21; before 2024.5
CVE-2021-44178
6.1
1%
Jan 13
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a reflected Cross-Site Scripting (XSS) vulnerability via the itemResourceType parameter
Affected: through 6.5.10.0
CVE-2021-44177
6.1
2%
Jan 13
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…
Affected: through 6.5.10.0
CVE-2021-44176
6.1
2%
Jan 13
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…
Affected: through 6.5.10.0
CVE-2021-43765
6.1
2%
Jan 13
AEM's Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to…
Affected: through 6.5.10.0
CVE-2021-40714
6.1
1%
Sep 27
Adobe Experience Manager version 6.5.9.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability via the accesskey parameter
Affected: through 6.5.9.0
CVE-2021-28628
6.1
1%
Aug 24
Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by an…
Affected: through 6.5.8.0
CVE-2021-28625
6.1
1%
Aug 24
Adobe Experience Manager Cloud Service offering, as well as versions 6.5.8.0 (and below) is affected by a Cross-Site Scripting (XSS) vulnerability that could be abused by an…
Affected: through 6.5.8.0
CVE-2021-21084
6.1
2%
Jun 28
AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by a stored Cross-Site Scripting (XSS)…
Affected: through 6.3.3.8; 6.4.0.0 before 6.4.8.4; 6.5.0.0 before 6.5.8.0
CVE-2020-9743
6.1
2%
Sep 10
AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor…
Affected: 6.3.0.0 through 6.3.3.8; 6.4.0.0 through 6.4.8.1; 6.5.0.0 through 6.5.5.0; 6.2.0.0; 6.2.0.0; 6.2.0.0; +18 more
CVE-2020-9651
6.1
2%
Jun 12
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (reflected) vulnerability
Affected: 6.4 before 6.4.8.1; 6.5 before 6.5.5.0
CVE-2020-9648
6.1
2%
Jun 12
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting vulnerability
Affected: 6.4 before 6.4.8.1; 6.5 before 6.5.5.0
CVE-2020-9647
6.1
2%
Jun 12
Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting (dom-based) vulnerability
Affected: 6.4 before 6.4.8.1; 6.5 before 6.5.5.0
CVE-2019-16467
6.1
1%
Jan 15
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability
Affected: 6.0; 6.1; 6.2; 6.3; 6.4; 6.5
CVE-2019-16466
6.1
1%
Jan 15
Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability
Affected: 6.3 before 6.3.3.7; 6.4 before 6.4.7.0; 6.5 before 6.5.3.0
CVE-2019-8085
6.1
1%
Oct 25
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability
Affected: 6.2; 6.3; 6.4; 6.5
CVE-2019-8084
6.1
1%
Oct 25
Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability
Affected: 6.2; 6.3; 6.4; 6.5
CVE-2019-8083
6.1
1%
Oct 25
Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability
Affected: 6.3; 6.4; 6.5
CVE-2019-8080
6.1
2%
Oct 24
Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability
Affected: 6.3; 6.4
CVE-2019-8079
6.1
1%
Oct 24
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross site scripting vulnerability
Affected: 6.0; 6.1; 6.2; 6.3; 6.4
CVE-2019-8078
6.1
2%
Oct 24
Adobe Experience Manager versions 6.4, 6.3 and 6.2 have a reflected cross site scripting vulnerability
Affected: 6.2; 6.3; 6.4
CVE-2019-7955
6.1
2%
Jul 18
Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability
Affected: 6.2 through 6.5
CVE-2019-7954
6.1
2%
Jul 18
Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability
Affected: 6.2 through 6.5
CVE-2018-19724
6.1
2%
Jan 28
Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability
Affected: 6.2.0; 6.3.0; 6.4.0
CVE-2018-19726
6.1
2%
Jan 28
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability
Affected: 6.0.0; 6.1.0; 6.2.0; 6.3.0; 6.4.0
CVE-2018-19727
6.1
2%
Jan 28
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability
Affected: 6.3.0; 6.4.0
CVE-2018-15973
6.1
2%
Oct 17
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability
Affected: 6.0.0; 6.1.0; 6.2.0; 6.3.0; 6.4.0
CVE-2018-15972
6.1
2%
Oct 17
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability
Affected: 6.0.0; 6.1.0; 6.2.0; 6.3.0; 6.4.0
CVE-2018-15971
6.1
2%
Oct 17
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability
Affected: 6.0.0; 6.1.0; 6.2.0; 6.3.0; 6.4.0
CVE-2018-15970
6.1
2%
Oct 17
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability
Affected: 6.0.0; 6.1.0; 6.2.0; 6.3.0; 6.4.0
CVE-2018-15969
6.1
2%
Oct 17
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a stored cross-site scripting vulnerability
Affected: 6.3.0; 6.4.0
CVE-2018-5005
6.1
4%
Sep 6
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a Cross-site Scripting vulnerability
Affected: 6.3.2.1 through 6.3.2.2; 6.4; 6.2.1.1 through 6.2.1.14
CVE-2018-12806
6.1
4%
Aug 29
Adobe Experience Manager versions 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability
Affected: 6.1.2.1 through 6.1.2.16; 6.2.1.1 through 6.2.1.15
CVE-2018-4931
6.1
2%
May 19
Adobe Experience Manager versions 6.1 and earlier have an exploitable stored cross-site scripting vulnerability
Affected: through 6.1.0
CVE-2018-4930
6.1
2%
May 19
Adobe Experience Manager versions 6.3 and earlier have an exploitable Cross-site scripting vulnerability
Affected: through 6.3.0
CVE-2018-4929
6.1
2%
May 19
Adobe Experience Manager versions 6.2 and earlier have an exploitable stored cross-site scripting vulnerability
Affected: through 6.2.0
CVE-2018-4876
6.1
4%
Feb 27
Adobe Experience Manager versions 6.3, 6.2, and 6.1 are vulnerable to cross-site scripting via a bypass of the Sling XSSAPI#getValidHref function
Affected: 6.1.0; 6.2.0; 6.3.0
CVE-2018-4875
6.1
4%
Feb 27
Adobe Experience Manager versions 6.1 and 6.0 are vulnerable to a reflected cross-site scripting vulnerability related to the handling of malicious content embedded in image files…
Affected: 6.0.0; 6.1.0
CVE-2017-3109
6.1
3%
Dec 9
An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0
Affected: 6.0.0; 6.1.0; 6.2.0; 6.3.0
CVE-2017-11296
6.1
3%
Dec 9
An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0
Affected: 6.0.0; 6.1.0; 6.2.0; 6.3.0
Page 2 of 10 · 500 total
123…10
The 500 most important CVEs for this product (exploited first, then by severity)