CVE-2025-54256
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-15
Assigner: Adobe Systems Incorporated
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | dreamweaver | to 21.6 (exc) |
| apple | macos | * |
| microsoft | windows | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to arbitrary code execution with the privileges of the current user, potentially allowing attackers to compromise user data, install malware, or perform unauthorized actions on the affected system.
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in Dreamweaver Desktop versions 21.5 and earlier. It allows an attacker to execute arbitrary code in the context of the current user if the user clicks on a malicious link. The scope of the vulnerability is changed, meaning it can affect the user's environment or data.