本页列出影响 adobe experience_manager_forms 的已公开 CVE 漏洞（通过 NVD CPE 关联）。每行包含严重程度评分、摘要与发布日期，便于识别与分析安全问题。
| CVE | 摘要 | 来源 | 最高 CVSS | EPSS % | 公开时间 | 更新时间 |
|---|---|---|---|---|---|---|
| CVE-2025-54254 | Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope is changed. Exploitation of this issue does not require user interaction. | [email protected] | 8.6 | 85.53% | 2025-08-05 | 2025-10-02 |
| CVE-2025-54253 KEV | Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed. | [email protected] | 10.0 | 89.82% | 2025-08-05 | 2025-10-23 |
| CVE-2020-9733 | An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to sensitive data in an AEM repository. | [email protected] | 7.5 | 3.75% | 2020-09-10 | 2024-11-21 |
| CVE-2020-9732 | The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Sites component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field. | [email protected] | 9.0 | 2.81% | 2020-09-10 | 2024-11-21 |
| CVE-2019-8089 | Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | [email protected] | 6.1 | 1.50% | 2019-10-22 | 2024-11-21 |
| CVE-2019-7129 | Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | [email protected] | 6.1 | 1.63% | 2019-05-29 | 2024-11-21 |
| CVE-2017-3067 | Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms. | [email protected] | 7.5 | 4.79% | 2017-05-09 | 2026-05-13 |
| CVE-2016-6934 | Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks. | [email protected] | 6.1 | 2.60% | 2016-12-15 | 2026-05-06 |