{"cve":"CVE-2022-28820","nvd":{"published":"2022-04-21T19:15:09.053","modified":"2026-06-17T04:39:08.073","status":"Modified","description":"ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to someone with access to AEM Author, and could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The exploitation of this issue requires user interaction in order to be successful.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/Adobe-Consulting-Services/acs-aem-commons/security/advisories/GHSA-w5m2-299g-rff5","https://github.com/Adobe-Consulting-Services/acs-aem-commons/security/advisories/GHSA-w5m2-299g-rff5"],"products":["adobe:acs_aem_commons"],"source":"nvd","synced_at":"2026-10-19T21:30:03.577988018+00:00"},"epss":{"cve":"CVE-2022-28820","score":0.01065,"percentile":0.64712,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-w5m2-299g-rff5","url":"https://osv.dev/vulnerability/GHSA-w5m2-299g-rff5","summary":"Page Compare Reflected Cross-site Scripting (XSS) vulnerability","modified":"2026-07-08T06:27:34.317954688Z","packages":[{"ecosystem":"Maven","name":"com.adobe.acs:acs-aem-commons","purl":"pkg:maven/com.adobe.acs/acs-aem-commons","ranges":["<5.2.0"],"fixed":["5.2.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}