CVE-2020-9743 | ByteOS Network

Vulnerability Details :

CVE-2020-9743

Assigner-adobe

Assigner Org ID-078d4453-3bcd-4900-85e6-15281da43538

Published At-10 Sep, 2020 | 16:36

Updated At-16 Sep, 2024 | 18:28

HTML injection in AEM's content editor component

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in the page (ex. phishing).

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:10 Sep, 2020 | 16:36

Updated At:16 Sep, 2024 | 18:28

▼CVE Numbering Authority (CNA)

HTML injection in AEM's content editor component

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in the page (ex. phishing).

Affected Products

Vendor

Product

Experience Manager

Versions

Affected

From unspecified through 6.5.5.0 (custom)
From unspecified through 6.4.8.1 (custom)
From unspecified through 6.3.3.8 (custom)
From unspecified through 6.2 SP1-CFP20 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-20	Improper Input Validation (CWE-20)

Type: CWE

CWE ID: CWE-20

Description: Improper Input Validation (CWE-20)

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html	x_refsource_MISC

Hyperlink: https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html	x_refsource_MISC x_transferred

Hyperlink: https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@adobe.com

Published At:10 Sep, 2020 | 17:15

Updated At:14 Sep, 2021 | 17:30

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below), 6.3.3.8 (and below) and 6.2 SP1-CFP20 (and below) are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An attacker could then use the malicious GET request to lure victims to perform unsafe actions in the page (ex. phishing).

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

>>experience_manager>>Versions from 6.3.0.0(inclusive) to 6.3.3.8(inclusive)

cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*

>>experience_manager>>Versions from 6.4.0.0(inclusive) to 6.4.8.1(inclusive)

cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*

>>experience_manager>>Versions from 6.5.0.0(inclusive) to 6.5.5.0(inclusive)

cpe:2.3:a:adobe:experience_manager:*:*:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp1:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp10:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp11:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp12.1:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp13:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp14:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp15:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp16:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp17:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp18:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp19:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp2:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp20:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp3:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp4:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp5:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp6:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp7:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp8:*:*:*:*:*:*

>>experience_manager>>6.2.0.0

cpe:2.3:a:adobe:experience_manager:6.2.0.0:sp1-cfp9:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov
CWE-20	Secondary	psirt@adobe.com

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-20

Type: Secondary

Source: psirt@adobe.com

References

Hyperlink	Source	Resource
https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html	psirt@adobe.com	Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/experience-manager/apsb20-56.html

Source: psirt@adobe.com

Resource:

Vendor Advisory

Similar CVEs

20651Records found

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.21% / 79.00%

||

7 Day CHG~0.00%

Published-09 Dec, 2017 | 06:00

Updated-20 Apr, 2025 | 01:37

An issue was discovered in Adobe Connect 9.6.2 and earlier versions. A reflected cross-site scripting vulnerability exists that can result in information disclosure.

Vendor-n/a Adobe Inc.

Product-connect Adobe Connect 9.6.2 and earlier versions

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.85% / 74.91%

||

7 Day CHG~0.00%

Published-24 Oct, 2019 | 17:24

Updated-04 Aug, 2024 | 21:10

Adobe Experience Manager versions 6.4 and 6.3 have a stored cross site scripting vulnerability. Successful exploitation could lead to privilege escalation.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.18% / 78.78%

||

7 Day CHG~0.00%

Published-18 Jul, 2019 | 21:49

Updated-04 Aug, 2024 | 21:02

Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.

Vendor-n/a Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.07% / 77.72%

||

7 Day CHG~0.00%

Published-14 Jul, 2017 | 05:00

Updated-20 Apr, 2025 | 01:37

Adobe Connect versions 9.6.1 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to a stored cross-site scripting attack.

Vendor-n/a Adobe Inc.

Product-connect Adobe Connect 9.6.1 and earlier.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.09% / 78.00%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:11

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a cross-site scripting vulnerability. Successful exploitation could lead to information disclosure.

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.28% / 79.59%

||

7 Day CHG~0.00%

Published-01 Dec, 2017 | 08:00

Updated-20 Apr, 2025 | 01:37

Adobe RoboHelp has a cross-site scripting (XSS) vulnerability. This affects versions before RH12.0.4.460 and RH2017 before RH2017.0.2.

Vendor-n/a Adobe Inc.Microsoft Corporation

Product-robohelp windows Adobe RoboHelp RH2017.0.1 and earlier versions

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.38% / 80.29%

||

7 Day CHG~0.00%

Published-22 Oct, 2019 | 20:50

Updated-04 Aug, 2024 | 21:10

Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager_forms Adobe Experience Manager Forms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.47% / 80.97%

||

7 Day CHG~0.00%

Published-09 Dec, 2017 | 06:00

Updated-20 Apr, 2025 | 01:37

An issue was discovered in Adobe Experience Manager 6.3, 6.2, 6.1, 6.0. Adobe Experience Manager has a reflected cross-site scripting vulnerability in the HtmlRendererServlet.

Vendor-n/a Adobe Inc.

Product-experience_manager Adobe Experience Manager 6.3, 6.2, 6.1, 6.0

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.89% / 75.58%

||

7 Day CHG~0.00%

Published-27 Apr, 2017 | 14:00

Updated-20 Apr, 2025 | 01:37

Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability.

Vendor-n/a Adobe Inc.

Product-coldfusion Adobe ColdFusion ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-5.5||MEDIUM

EPSS-2.50% / 85.35%

||

7 Day CHG~0.00%

Published-11 Jan, 2017 | 04:40

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have a security bypass vulnerability when manipulating Form Data Format (FDF).

Vendor-n/a Adobe Inc.Apple Inc.Microsoft Corporation

Product-acrobat mac_os_x acrobat_dc reader acrobat_reader_dc windows Adobe Acrobat Reader 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier.

CWE ID-CWE-20

Improper Input Validation

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-3.87% / 88.25%

||

7 Day CHG~0.00%

Published-24 Jan, 2017 | 07:40

Updated-20 Apr, 2025 | 01:37

Adobe Acrobat Chrome extension version 15.1.0.3 and earlier have a DOM-based cross-site scripting vulnerability. Successful exploitation could lead to JavaScript code execution.

Vendor-n/a Adobe Inc.Microsoft Corporation

Product-acrobat windows Adobe Acrobat Extension for Chrome 15.1.0.3

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.53% / 67.20%

||

7 Day CHG~0.00%

Published-13 May, 2025 | 20:32

Updated-19 May, 2025 | 20:29

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect versions 12.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Vendor-Adobe Inc.

Product-connect Adobe Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.74% / 72.96%

||

7 Day CHG~0.00%

Published-08 Apr, 2025 | 20:03

Updated-14 Apr, 2025 | 15:57

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Vendor-Adobe Inc.

Product-coldfusion ColdFusion

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.53% / 67.20%

||

7 Day CHG~0.00%

Published-13 May, 2025 | 20:32

Updated-19 May, 2025 | 20:29

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect versions 12.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Vendor-Adobe Inc.

Product-connect Adobe Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.96% / 83.52%

||

7 Day CHG~0.00%

Published-13 Aug, 2008 | 00:00

Updated-07 Aug, 2024 | 09:45

Multiple cross-site scripting (XSS) vulnerabilities in files generated by Adobe Presenter 6 and 7 before 7.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) viewer.swf and (2) loadflash.js, a different vulnerability than CVE-2008-3515.

Vendor-n/a Adobe Inc.

Product-presenter n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Red Hat, Inc.

Matching Score-10

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-1.96% / 83.52%

||

7 Day CHG~0.00%

Published-13 Aug, 2008 | 00:00

Updated-07 Aug, 2024 | 09:45

Multiple cross-site scripting (XSS) vulnerabilities in files generated by Adobe Presenter 6 and 7 before 7.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) viewer.swf and (2) loadflash.js, a different vulnerability than CVE-2008-3516.

Vendor-n/a Adobe Inc.

Product-presenter n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-3.00% / 86.58%

||

7 Day CHG~0.00%

Published-09 Jul, 2008 | 18:00

Updated-23 Apr, 2025 | 15:43

Cross-site scripting (XSS) vulnerability in Adobe RoboHelp Server 6 and 7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Help Errors log.

Vendor-n/a Adobe Inc.

Product-robohelp_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.80% / 86.13%

||

7 Day CHG~0.00%

Published-18 Jun, 2008 | 19:29

Updated-07 Aug, 2024 | 09:05

Multiple cross-site scripting (XSS) vulnerabilities in the Flex 3 History Management feature in Adobe Flex 3.0.1 SDK and Flex Builder 3, and generated applications, allow remote attackers to inject arbitrary web script or HTML via the anchor identifier to (1) client-side-detection-with-history/history/historyFrame.html, (2) express-installation-with-history/history/historyFrame.html, or (3) no-player-detection-with-history/history/historyFrame.html in templates/html-templates/. NOTE: Firefox 2.0 and possibly other browsers prevent exploitation.

Vendor-n/a Adobe Inc.

Product-flex_builder flex n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.03% / 77.37%

||

7 Day CHG~0.00%

Published-01 Dec, 2017 | 08:00

Updated-20 Apr, 2025 | 01:37

Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

Vendor-n/a Adobe Inc.

Product-coldfusion Adobe ColdFusion Update 4 and earlier versions for ColdFusion 2016 release. Update 12 and earlier versions for ColdFusion 11.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-27.26% / 96.41%

||

7 Day CHG~0.00%

Published-09 Apr, 2008 | 21:00

Updated-07 Aug, 2024 | 08:32

Unspecified vulnerability in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, makes it easier for remote attackers to conduct DNS rebinding attacks via unknown vectors.

Vendor-n/a Adobe Inc.

Product-flash_player flex air n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-38.24% / 97.23%

||

7 Day CHG~0.00%

Published-04 Jan, 2008 | 00:00

Updated-07 Aug, 2024 | 16:11

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player allow remote attackers to inject arbitrary web script or HTML via a crafted SWF file, related to "pre-generated SWF files" and Adobe Dreamweaver CS3 or Adobe Acrobat Connect. NOTE: the asfunction: vector is already covered by CVE-2007-6244.1.

Vendor-n/a Adobe Inc.

Product-flash_player n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-69.08% / 98.64%

||

7 Day CHG~0.00%

Published-20 Dec, 2007 | 01:00

Updated-07 Aug, 2024 | 16:02

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.

Vendor-n/a Adobe Inc.

Product-flash_player n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-TR-CERT (Computer Emergency Response Team of the Republic of Türkiye)

Matching Score-10

Assigner-TR-CERT (Computer Emergency Response Team of the Republic of Türkiye)

CVSS Score-6.1||MEDIUM

EPSS-0.29% / 52.13%

||

7 Day CHG~0.00%

Published-15 Sep, 2023 | 08:37

Updated-24 Sep, 2025 | 19:37

XSS in Saphira Connect

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Saphira Saphira Connect allows Reflected XSS.This issue affects Saphira Connect: before 9.

Vendor-Saphira Adobe Inc.

Product-connect Saphira Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.32% / 79.87%

||

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe Experience Manager versions 6.1 and earlier have an input validation issue in the DAM create assets that could be used in cross-site scripting attacks.

Vendor-n/a Adobe Inc.

Product-experience_manager Adobe Experience Manager 6.1 and earlier

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.32% / 79.87%

||

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe Experience Manager version 6.2 has an input validation issue in create Launch wizard that could be used in cross-site scripting attacks.

Vendor-n/a Adobe Inc.

Product-experience_manager Adobe Experience Manager 6.2

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.25% / 79.36%

||

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe Experience Manager versions 6.2 and earlier have an input validation issue in the WCMDebug filter that could be used in cross-site scripting attacks.

Vendor-n/a Adobe Inc.

Product-experience_manager Adobe Experience Manager 6.2 and earlier

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.19% / 78.86%

||

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the AACComponent that could be used in cross-site scripting attacks.

Vendor-n/a Adobe Inc.

Product-livecycle experience_manager Adobe Experience Manager Forms 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.90% / 75.72%

||

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks.

Vendor-n/a Adobe Inc.

Product-livecycle experience_manager_forms Adobe Experience Manager Forms 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-5.71% / 90.43%

||

7 Day CHG~0.00%

Published-08 Nov, 2016 | 17:45

Updated-12 Apr, 2025 | 10:46

Adobe Connect version 9.5.6 and earlier does not adequately validate input in the events registration module. This vulnerability could be exploited in cross-site scripting attacks.

Vendor-n/a Adobe Inc.

Product-connect Adobe Connect 9.5.6 and earlier versions

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.92% / 76.03%

||

7 Day CHG~0.00%

Published-15 Dec, 2016 | 06:31

Updated-12 Apr, 2025 | 10:46

Adobe RoboHelp version 2015.0.3 and earlier, RoboHelp 11 and earlier have an input validation issue that could be used in cross-site scripting attacks.

Vendor-n/a Microsoft Corporation Adobe Inc.

Product-robohelp windows Adobe RoboHelp 2015.0.3 and earlier, RoboHelp 11 and earlier

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-61.36% / 98.33%

||

7 Day CHG~0.00%

Published-03 Jan, 2007 | 20:00

Updated-07 Aug, 2024 | 12:03

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Acrobat Reader Plugin before 8.0.0, and possibly the plugin distributed with Adobe Reader 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2, for Mozilla Firefox, Microsoft Internet Explorer 6 SP1, Google Chrome, Opera 8.5.4 build 770, and Opera 9.10.8679 on Windows allow remote attackers to inject arbitrary JavaScript and conduct other attacks via a .pdf URL with a javascript: or res: URI with (1) FDF, (2) XML, and (3) XFDF AJAX parameters, or (4) an arbitrarily named name=URI anchor identifier, aka "Universal XSS (UXSS)."

Vendor-n/a Adobe Inc.

Product-acrobat_3d acrobat_reader acrobat n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.02% / 83.81%

||

7 Day CHG~0.00%

Published-14 Feb, 2007 | 02:00

Updated-07 Aug, 2024 | 20:04

Cross-site scripting (XSS) vulnerability in the administrator console for Adobe JRun 4.0, as used in ColdFusion, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

Vendor-n/a Adobe Inc.

Product-jrun coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.44% / 85.18%

||

7 Day CHG~0.00%

Published-14 Feb, 2007 | 01:00

Updated-07 Aug, 2024 | 20:04

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1, when Global Script Protection is not enabled, allows remote attackers to inject arbitrary HTML and web script via unknown vectors, possibly related to Linkdirect.cfm, Topnav.cfm, and Welcomedoc.cfm.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-0.67% / 71.30%

||

7 Day CHG~0.00%

Published-14 Dec, 2011 | 11:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the cfform tag.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-1.08% / 77.84%

||

7 Day CHG~0.00%

Published-07 Jun, 2011 | 19:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability."

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

Product-linux_kernel windows acrobat_reader acrobat flash_player android sunos mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-0.78% / 73.81%

||

7 Day CHG~0.00%

Published-26 Oct, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in Adobe RoboHelp 7 and 8, and RoboHelp Server 7 and 8, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-robohelp_server robohelp n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.64% / 70.63%

||

7 Day CHG~0.00%

Published-09 Aug, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Experience Manager 5.6.1, 6.0, and 6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-experience_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-2.39% / 85.03%

||

7 Day CHG~0.00%

Published-10 Feb, 2011 | 15:00

Updated-11 Apr, 2025 | 00:51

Multiple CRLF injection vulnerabilities in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified tags.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.75% / 73.23%

||

7 Day CHG~0.00%

Published-09 Aug, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Experience Manager 5.6.1, 6.0, 6.1, and 6.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-experience_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.94% / 76.31%

||

7 Day CHG~0.00%

Published-01 Feb, 2011 | 17:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.64% / 70.48%

||

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Brackets before 1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-brackets n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.64% / 81.97%

||

7 Day CHG~0.00%

Published-15 Jan, 2020 | 16:16

Updated-05 Aug, 2024 | 01:17

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.64% / 81.97%

||

7 Day CHG~0.00%

Published-15 Jan, 2020 | 16:13

Updated-05 Aug, 2024 | 01:17

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-5.9||MEDIUM

EPSS-2.49% / 85.34%

||

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-20

Improper Input Validation

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.23% / 79.16%

||

7 Day CHG~0.00%

Published-11 May, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.64% / 70.48%

||

7 Day CHG~0.00%

Published-22 Apr, 2016 | 18:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe Analytics AppMeasurement for Flash Library before 4.0.1, when debugTracking is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-analytics_appmeasurement_for_flash_library n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-0.82% / 74.34%

||

7 Day CHG~0.00%

Published-13 May, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.70% / 71.98%

||

7 Day CHG~0.00%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Adobe Inc.

Product-coldfusion n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-4.3||MEDIUM

EPSS-1.39% / 80.38%

||

7 Day CHG~0.00%

Published-14 Apr, 2010 | 15:44

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-Adobe Systems Incorporated

Matching Score-10

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.07% / 21.14%

||

7 Day CHG~0.00%

Published-14 Apr, 2026 | 17:33

Updated-15 Apr, 2026 | 16:14

Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

Vendor-Adobe Inc.

Product-Adobe Connect

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')