CVE-2025-54254
Adobe Experience Manager versions 6.5.23 and earlier are affected by
Description
Description
Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope is changed. Exploitation of this issue does not require user interaction.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Affected Vendors & Products
| Vendor | Product | Version |
|---|---|---|
| adobe | experience_manager_forms | to 6.5.23.0 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
Can you explain this vulnerability to me?
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart
Meta Information
CVE Publication Date:
2025-08-05
CVE Last Modified Date:
2025-10-02
Report Generation Date:
2025-11-07
AI Powered Q&A Generation:
2025-08-05
EPSS Last Evaluated Date:
2025-09-10
NVD Report Link: