CVE-2025-64605: Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64605?
CVE-2025-64605 is a critical vulnerability that allows stored Cross-Site Scripting (XSS) attacks in Adobe Experience Manager.
How does CVE-2025-64605 affect Adobe Experience Manager?
CVE-2025-64605 enables low privileged attackers to inject malicious scripts into form fields of Adobe Experience Manager.
Who can exploit CVE-2025-64605?
CVE-2025-64605 can be exploited by low privileged attackers with access to vulnerable form fields in Adobe Experience Manager.
What is the impact of an exploit of CVE-2025-64605?
Exploiting CVE-2025-64605 may lead to the execution of malicious JavaScript in a victim's browser, potentially compromising user data.
How do I fix CVE-2025-64605?
To fix CVE-2025-64605, upgrade to a version of Adobe Experience Manager later than 6.5.23 that addresses the XSS vulnerability.