CVE-2025-64537: Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by injecting malicious scripts into a web page that are executed in the context of the victim's browser. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Exploitation of this issue requires user interaction in that a victim must visit a crafted malicious page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64537?
CVE-2025-64537 is rated as a critical severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2025-64537?
To mitigate CVE-2025-64537, update Adobe Experience Manager to version 6.5.24 or later.
What types of attacks can CVE-2025-64537 enable?
CVE-2025-64537 can enable DOM-based Cross-Site Scripting (XSS) attacks that allow attackers to execute malicious scripts.
Who is affected by CVE-2025-64537?
CVE-2025-64537 affects users of Adobe Experience Manager versions 6.5.23 and earlier.
What should I do if I cannot immediately update to fix CVE-2025-64537?
If an immediate update is not feasible, implement web application firewalls or other security measures to help mitigate the risks associated with CVE-2025-64537.