Omnispace Agora Project versions before 26.10.0 have a vulnerability where the persistent remember-me token is stored in plaintext on the server. This token is identical to the bearer credential in the user's cookie, allowing attackers who access the stored token to authenticate as the user without a password.
CVE-2026-63159 affects Omnispace Agora Project versions before 26.10.0 and involves a weak password recovery mechanism. The vulnerability arises because the password-reset token is generated deterministically as sha1(login.password), making it predictable and reusable. This allows unauthenticated attackers to compute or brute-force valid reset tokens from known or guessed login and password combinations, enabling account takeover.
Omnispace Agora Project versions before 26.10.0 have an authentication bypass vulnerability. Attackers who obtain a user's stored bcrypt password hash can authenticate as that user without knowing the actual password. This is due to the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the password hash as a bearer token. Exploitation allows impersonation of any user, including administrators, leading to unauthorized access.
CVE-2026-63149 is a critical vulnerability in Omnispace Agora Project versions before 26.10.0. It involves the use of insufficiently random values for generating temporary or default account passwords via PHP's uniqid() function, which is based on server time in microseconds. This predictability allows attackers who can observe or approximate the account creation time to compute the password and potentially take over the account before the legitimate user logs in.
CVE-2026-90532 is an Incorrect Authorization vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker to execute arbitrary code with the privileges of the current user without requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability, with a critical severity rating and a CVSS score of 10.0. Affected versions include those up to 2026.9.28187 and version 6.5.25. No explicit patch or remediation information is provided. The vulnerability changes the security scope, potentially allowing elevated access or control over victim accounts or sessions.
Adobe Experience Manager as a Cloud Service contains an Improper Restriction of XML External Entity Reference (XXE) vulnerability (CWE-611) that allows a low-privileged attacker to escalate privileges and gain elevated access to internal resources without user interaction. The vulnerability affects multiple versions up to 2026.9.28187 and 6.5.25. The issue changes the security scope and has a critical severity rating with a CVSS score of 9.6.
Adobe Experience Manager as a Cloud Service is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). This vulnerability allows an attacker to manipulate the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability impacts confidentiality and integrity but not availability. The CVSS score is 5.4, indicating a medium severity level.
Adobe Experience Manager as a Cloud Service is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). This vulnerability allows an attacker to manipulate the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability impacts confidentiality and integrity with no impact on availability. The severity is rated medium with a CVSS score of 5.4.
Adobe Experience Manager as a Cloud Service is affected by a critical reflected Cross-Site Scripting (XSS) vulnerability (CVE-2026-83662). This vulnerability allows an attacker to inject malicious scripts via crafted URLs or compromised web pages, potentially leading to elevated access or control over a victim's account or session. Exploitation requires user interaction. The vulnerability impacts confidentiality and integrity but not availability. No explicit patch or remediation details are provided. The affected versions include 0 through 6.5.25 and up to 2026.9.28187.
Adobe Experience Manager 6.5 LTS suffers from an Incorrect Authorization vulnerability (CWE-863) that allows arbitrary code execution with elevated privileges in the context of the current user. Exploitation does not require user interaction and changes the security scope, potentially compromising the victim's account or session.
Adobe Experience Manager 6.5 contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows an attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment. Exploitation requires the victim to visit a crafted webpage, and the vulnerability affects versions up to and including 6.5.25. The vulnerability has a medium severity with a CVSS score of 5.4. No patch or official remediation information is provided in the available data.
CVE-2026-48383 is a critical Incorrect Authorization vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability can lead to elevated access or control over the victim's account or session, with a changed scope indicating potential broader impact.
CVE-2026-48382 is an incorrect authorization vulnerability in Adobe Experience Manager as a Cloud Service. This flaw allows an attacker to execute arbitrary code with the privileges of the current user without requiring any user interaction. The vulnerability has a critical severity with a CVSS score of 10. Exploitation can lead to full compromise of the victim's account or session. No patch or official remediation information is provided in the available data.
Adobe Experience Manager 6.5 contains an XML Injection (Blind XPath Injection) vulnerability that allows a low-privileged attacker to bypass security features and gain unauthorized read and limited write access. Exploitation does not require user interaction. The vulnerability affects versions up to and including 6.5.25. The CVSS score is 7.1, indicating a high severity issue.
Adobe Experience Manager 6.5 contains an SQL Injection vulnerability (CWE-89) that allows a low-privileged attacker to bypass security features and gain unauthorized read and limited write access. Exploitation does not require user interaction. The vulnerability affects versions up to and including 6.5.25. The CVSS 3.1 score is 7.1, indicating high severity.
Adobe Experience Manager 6.5 LTS is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can exploit this by convincing a victim to visit a crafted URL, causing malicious JavaScript to execute in the victim's browser context. The vulnerability affects versions up to and including 6.5.25. The CVSS score is 5.4, indicating a medium severity issue.
Adobe Experience Manager 6.5 LTS contains a stored Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious scripts into form fields. When a victim views the affected page, the malicious JavaScript may execute in their browser. This vulnerability affects versions up to and including 6.5.25. The vulnerability has a medium severity rating with a CVSS score of 5.4.
Adobe Experience Manager 6.5 contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows an attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability affects versions up to and including 6.5.25. The vulnerability has a medium severity with a CVSS score of 5.4.
Adobe Experience Manager 6.5 contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2026-110079) that allows an attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability affects versions up to and including 6.5.25. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component. The CVSS score is 5.4 (medium severity).
Adobe Experience Manager 6.5 contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows an attacker to execute malicious JavaScript in the victim's browser by manipulating the DOM environment. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability affects versions up to and including 6.5.25. The CVSS score is 5.4, indicating a medium severity issue.