AI and data stack advisories

Severe, 6 weeks977Projects326

977 severe, 6 weeks · 326 projects

AdobeCVE-2026-48398

Adobe Experience Manager 6.5: cross-site scripting

Adobe

CVE-2026-48398 · Published Oct 13, 2026 · updated Oct 31, 2026

Medium5.4
No fix yet
Adobe advisory

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

Affected versions

PackageAffectedFixed in
Adobe Experience Manager 6.5
Product
<= 6.5.25No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-79

More Adobe advisories

All Adobe
High 7.8Oct 13Adobe Photoshop: out-of-bounds writeCVE-2026-96521no fix yetCritical 9.6Oct 13Adobe Experience Manager: XML external entityCVE-2026-90531no fix yetCritical 10.0Oct 13Adobe Experience Manager: improper authorizationCVE-2026-90532no fix yetMedium 5.4Oct 13Adobe Experience Manager: cross-site scriptingCVE-2026-83958no fix yetMedium 5.4Oct 13Adobe Experience Manager: cross-site scriptingCVE-2026-83960no fix yetCritical 9.3Oct 13Adobe Experience Manager: cross-site scriptingCVE-2026-83662no fix yet