Vulnerability Database

314,343

Total vulnerabilities in the database

CVE-2020-9742

AEM versions 6.5.5.0 (and below), 6.4.8.1 (and below) and 6.3.3.8 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Inbox calendar feature. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.

  • Published: Sep 10, 2020
  • Updated: Nov 16, 2025
  • CVE: CVE-2020-9742
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9
  • AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CVSS v2:

  • Severity: Low
  • Score: 3.5
  • AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
adobe / experience_manager 6.5.0.0 6.5.5.0.x
adobe / experience_manager 6.4.0.0 6.4.8.1.x
adobe / experience_manager 6.3.0.0 6.3.3.8.x