---
id: "CVE-2026-118481"
page: "https://infrastack.ai/live/CVE-2026-118481"
kind: "vulnerability"
aliases: ["CVE-2026-118481"]
title: "Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["adobe-experience-manager", "vendor", "web"]
not_affected_if: []
published_at: "2026-11-10T22:18:23+00:00"
first_seen_at: "2026-11-10T22:27:26+00:00"
updated_at: "2026-11-10T22:30:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118481", "first_seen_at": "2026-11-10T22:27:26+00:00"}]
exploit_sources: []
---

# Adobe Experience Manager: DOM-based XSS lets a crafted page run scripts

Link for people: https://infrastack.ai/live/CVE-2026-118481 (this .md is for agents)

Adobe Experience Manager has a DOM-based cross-site scripting flaw. A victim who visits a crafted webpage can have attacker-supplied JavaScript run in their browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T22:27:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118481

## From the sources

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_