Vulnerability Description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Software Version: 6.5.24, LTS SP1, 2026.04 and earlier
CVSS: 5.4
Severity: Medium
NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-47990
Credits: Claudia Bartolini, Marco Ventura, Massimiliano Brolli
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Prerequisites: The attacker must have the ‘User’ privileges.
Step-by-step instructions and PoC
A remote user authenticated as 'user' can store malicious JavaScript code in the 'tag' parameter within the 'tagging' section. Successful exploitation of this vulnerability can lead to the extraction of sensitive information and/or the execution of arbitrary HTTP requests in the context of the victim's session.
Affected Endpoints
Below is the evidence with the vulnerability details and the payloads used.
Payload used to exploit the vulnerability:
Image 1 - Payload
As shown in the following figure, a malicious attacker with ‘user’ privilege can add a new malicious tag within the 'tagging' section.
Image 2 - Payload XSS
As shown in the figure below, when an admin visits the CRXDE Lite portal and clicks on the malicious tag, the malicious payload is executed.
Image 3 - XSS PoC
Security Impact
An attacker can exploit this vulnerability to extract some information or run arbitrary HTTP Request in the context of victim's session.