Adobe Dimension contains a stack-based buffer overflow vulnerability (CWE-121) that could allow an attacker to execute arbitrary code with the privileges of the current user. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 4.1.8. The CVSS 3.1 score is 7.8, indicating high severity.
Adobe Dimension contains an out-of-bounds read vulnerability (CWE-125) that could allow an attacker to disclose sensitive memory information. Exploitation requires user interaction, specifically opening a malicious file. The vulnerability affects versions from 0 up to and including 4.1.8. The CVSS 3.1 base score is 5.5, indicating a medium severity level.
Adobe Dimension versions up to 4.1.8 are affected by an Untrusted Search Path vulnerability (CWE-426) that could allow a local attacker with user permissions to execute arbitrary code. Exploitation requires user interaction, specifically running the vulnerable application. The vulnerability impacts confidentiality, integrity, and availability, and changes the security scope.
CVE-2026-90532 is an Incorrect Authorization vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker to execute arbitrary code with the privileges of the current user without requiring user interaction. The vulnerability impacts confidentiality, integrity, and availability, with a critical severity rating and a CVSS score of 10.0. Affected versions include those up to 2026.9.28187 and version 6.5.25. No explicit patch or remediation information is provided. The vulnerability changes the security scope, potentially allowing elevated access or control over victim accounts or sessions.
Adobe Experience Manager as a Cloud Service contains an Improper Restriction of XML External Entity Reference (XXE) vulnerability (CWE-611) that allows a low-privileged attacker to escalate privileges and gain elevated access to internal resources without user interaction. The vulnerability affects multiple versions up to 2026.9.28187 and 6.5.25. The issue changes the security scope and has a critical severity rating with a CVSS score of 9.6.
Adobe Experience Manager as a Cloud Service is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). This vulnerability allows an attacker to manipulate the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability impacts confidentiality and integrity but not availability. The CVSS score is 5.4, indicating a medium severity level.
Adobe Experience Manager as a Cloud Service is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79). This vulnerability allows an attacker to manipulate the DOM environment to execute malicious JavaScript in the victim's browser context. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability impacts confidentiality and integrity with no impact on availability. The severity is rated medium with a CVSS score of 5.4.
Adobe Experience Manager as a Cloud Service is affected by a critical reflected Cross-Site Scripting (XSS) vulnerability (CVE-2026-83662). This vulnerability allows an attacker to inject malicious scripts via crafted URLs or compromised web pages, potentially leading to elevated access or control over a victim's account or session. Exploitation requires user interaction. The vulnerability impacts confidentiality and integrity but not availability. No explicit patch or remediation details are provided. The affected versions include 0 through 6.5.25 and up to 2026.9.28187.
Adobe Experience Manager 6.5 LTS suffers from an Incorrect Authorization vulnerability (CWE-863) that allows arbitrary code execution with elevated privileges in the context of the current user. Exploitation does not require user interaction and changes the security scope, potentially compromising the victim's account or session.
Adobe Experience Manager 6.5 contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows an attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment. Exploitation requires the victim to visit a crafted webpage, and the vulnerability affects versions up to and including 6.5.25. The vulnerability has a medium severity with a CVSS score of 5.4. No patch or official remediation information is provided in the available data.
CVE-2026-48383 is a critical Incorrect Authorization vulnerability in Adobe Experience Manager as a Cloud Service. It allows an attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability can lead to elevated access or control over the victim's account or session, with a changed scope indicating potential broader impact.
CVE-2026-48382 is an incorrect authorization vulnerability in Adobe Experience Manager as a Cloud Service. This flaw allows an attacker to execute arbitrary code with the privileges of the current user without requiring any user interaction. The vulnerability has a critical severity with a CVSS score of 10. Exploitation can lead to full compromise of the victim's account or session. No patch or official remediation information is provided in the available data.
Adobe Experience Manager 6.5 contains an XML Injection (Blind XPath Injection) vulnerability that allows a low-privileged attacker to bypass security features and gain unauthorized read and limited write access. Exploitation does not require user interaction. The vulnerability affects versions up to and including 6.5.25. The CVSS score is 7.1, indicating a high severity issue.
Adobe Experience Manager 6.5 contains an SQL Injection vulnerability (CWE-89) that allows a low-privileged attacker to bypass security features and gain unauthorized read and limited write access. Exploitation does not require user interaction. The vulnerability affects versions up to and including 6.5.25. The CVSS 3.1 score is 7.1, indicating high severity.
Adobe Experience Manager 6.5 LTS is affected by a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can exploit this by convincing a victim to visit a crafted URL, causing malicious JavaScript to execute in the victim's browser context. The vulnerability affects versions up to and including 6.5.25. The CVSS score is 5.4, indicating a medium severity issue.
Adobe Experience Manager 6.5 LTS contains a stored Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious scripts into form fields. When a victim views the affected page, the malicious JavaScript may execute in their browser. This vulnerability affects versions up to and including 6.5.25. The vulnerability has a medium severity rating with a CVSS score of 5.4.
Adobe Experience Manager 6.5 contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows an attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability affects versions up to and including 6.5.25. The vulnerability has a medium severity with a CVSS score of 5.4.
Adobe Experience Manager 6.5 contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CVE-2026-110079) that allows an attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability affects versions up to and including 6.5.25. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component. The CVSS score is 5.4 (medium severity).
Adobe Experience Manager 6.5 contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows an attacker to execute malicious JavaScript in the victim's browser by manipulating the DOM environment. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability affects versions up to and including 6.5.25. The CVSS score is 5.4, indicating a medium severity issue.
Adobe Experience Manager 6.5 contains a DOM-based Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows an attacker to execute malicious JavaScript in a victim's browser by manipulating the DOM environment. Exploitation requires user interaction, specifically the victim visiting a crafted webpage. The vulnerability affects versions up to and including 6.5.25. The CVSS 3.1 base score is 5.4, indicating medium severity.