CVE-2025-54251: Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)
Published Sep 9, 2025
·Updated
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.
Affected Software
5 affected components
Adobe Experience Manager<6.5.23.0
Adobe Experience Manager<=6.5.23.0
Adobe Experience Manager<=2025.8.0
Adobe Experience Manager=6.5
Adobe Experience Manager=6.5-sp1
Event History
Sep 9, 2025
CVE Published
via MITRE·04:36 PM
Data Sourced
via MITRE·04:36 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-54251?
CVE-2025-54251 is classified as a low severity vulnerability.
2
How do I fix CVE-2025-54251?
To fix CVE-2025-54251, upgrade Adobe Experience Manager to version 6.5.24.0 or later.
3
What type of attack does CVE-2025-54251 facilitate?
CVE-2025-54251 facilitates an XML Injection attack that can result in a security feature bypass.
4
What versions of Adobe Experience Manager are affected by CVE-2025-54251?
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by CVE-2025-54251.
5
What can a low-privileged attacker achieve with CVE-2025-54251?
A low-privileged attacker can manipulate XML queries to gain limited unauthorized write access.