Experience Manager Forms
Vendor:
First CVE: Dec 15, 2016 · Active for 9 years
8
Total CVEs
More Total CVEs than 85% of tracked products
1.6
Avg CVEs / Year
Higher CVE frequency than 59% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 60% of tracked products
12.5%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Experience Manager Forms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 15, 2016
9 years ago
Most Recent CVE
Aug 5, 2025
354 days ago
CVE Severity & Scoring
Experience Manager Forms8 CVEs
38%
38%
25%
All CVEs352,427 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network8 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low8 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None4 (50.0%)
Unknown0 (0.0%)
Required4 (50.0%)
Privileges Required
Low1 (12.5%)
High0 (0.0%)
None7 (87.5%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-54253CRITICAL Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this | Aug 5, 2025 | 10.0 | 96 | YES | NO |
CVE-2025-54254HIGH Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary fil | Aug 5, 2025 | 8.6 | 74 | NO | NO |
CVE-2020-9732CRITICAL The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicio | Sep 10, 2020 | 9.0 | 27 | NO | NO |
CVE-2020-9733HIGH An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited, this could lead to re | Sep 10, 2020 | 7.5 | 24 | NO | NO |
CVE-2017-3067HIGH Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms. | May 9, 2017 | 7.5 | 21 | NO | NO |
CVE-2019-8089MEDIUM Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | Oct 22, 2019 | 6.1 | 20 | NO | NO |
CVE-2019-7129MEDIUM Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure. | May 29, 2019 | 6.1 | 17 | NO | NO |
CVE-2016-6934MEDIUM Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site sc | Dec 15, 2016 | 6.1 | 17 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (8 CVEs).
CISA KEV
1 CVE
12.5% of CVEs· 97th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (8 CVEs).
Media Mentions
Signals from CVEs in this product scope (8 CVEs).
Top CNAs Publishing CVEs For Experience Manager Forms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 6.5.5.0 | 2 | 8.3 | 3.3% | 0 | 0 |
| 6.5 | 1 | 6.1 | 1.5% | 0 | 0 |
| 6.4.8.1 | 2 | 8.3 | 3.3% | 0 | 0 |
| 6.4 | 2 | 6.1 | 1.6% | 0 | 0 |
| 6.3 | 2 | 6.1 | 1.6% | 0 | 0 |
| 6.2 | 2 | 6.8 | 3.2% | 0 | 0 |
| 6.1 | 1 | 7.5 | 4.8% | 0 | 0 |
| 6.0 | 1 | 7.5 | 4.8% | 0 | 0 |