Adobe experience manager forms vulnerabilities

Latest Adobe experience manager forms CVEs

Newest publication first

1. CVE-2025-54253 Adobe Experience Manager | Incorrect Authorization (CWE-863)

   Published 2025-08-05

   Critical·CVSS 10.0 EPSS 80.8% CISA KEV added 2025-10-15 Exploited in the wild PoC

   Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not r...

2. CVE-2025-54254 Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

   Published 2025-08-05

   High·CVSS 8.6 EPSS 53.9% PoC

   Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local f...

3. CVE-2020-9732 Stored XSS in AEM Sites Components

   Published 2020-09-10

   Critical·CVSS 9.0 EPSS 2.8%

   The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Sites component. These scripts may be executed in a victim’...

4. CVE-2020-9733 Sensitive information disclosure possible in AEM

   Published 2020-09-10

   High·CVSS 7.5 EPSS 3.8%

   An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to sensitive data in an AEM repository.

5. CVE-2019-8089 Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

   Published 2019-10-22

   Medium·CVSS 6.1 EPSS 1.5%

   Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

6. CVE-2019-7129 Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

   Published 2019-05-29

   Medium·CVSS 6.1 EPSS 1.6%

   Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

7. CVE-2017-3067 Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms.

   Published 2017-05-09

   High·CVSS 7.5 EPSS 4.8%

   Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms.

8. CVE-2016-6934 Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks.

   Published 2016-12-15

   Medium·CVSS 6.1 EPSS 2.6%

   Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.