CVE Tools
Track your stack

Experience Manager Forms

8 CVEs tracked. 1 of them are in CISA KEV.

This hub aggregates every CVE we track for Experience Manager Forms, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Experience Manager Forms CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Experience Manager Forms CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-082
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090
2026-100

Severity

How the 8 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical225%
  • High338%
  • Medium338%

Latest CVEs

The 8 most recently published vulnerabilities affecting Experience Manager Forms.

  1. CVE-2025-54253Adobe Experience Manager | Incorrect Authorization (CWE-863)10.0
  2. CVE-2025-54254Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)8.6
  3. CVE-2020-9732Stored XSS in AEM Sites Components9.0
  4. CVE-2020-9733Sensitive information disclosure possible in AEM7.5
  5. CVE-2019-8089Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.6.1
  6. CVE-2019-7129Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.6.1
  7. CVE-2017-3067Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms.7.5
  8. CVE-2016-6934Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks.6.1

Product grouping is registry-driven, with AI assist and human review. How it works