BaseFortify

Publication date: 2025-12-10

Last updated on: 2025-12-12

Assigner: Adobe Systems Incorporated

Description

Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-10

Last Modified

2025-12-12

Generated

2026-07-06

AI Q&A

2025-12-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64551

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	experience_manager	to 6.5.24.0 (inc)
adobe	experience_manager	6.5.23

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a DOM-based Cross-Site Scripting (XSS) issue in Adobe Experience Manager versions 6.5.23 and earlier. It allows a low privileged attacker to execute malicious scripts in the victim's browser by tricking the user into interacting with a crafted URL or manipulated web page.

Impact Analysis

The vulnerability can lead to malicious scripts running in the context of a user's browser, potentially allowing attackers to steal sensitive information, hijack user sessions, or perform actions on behalf of the user without their consent. Exploitation requires user interaction.

Hi! I’m here to help you understand CVE-2025-64551. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70