CVE-2025-49552CWE-79cross-site-scripting

CVE-2025-49552

High · published October 15, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

⚡ A crafty attacker could pull off a session takeover with just a single click! This XSS vulnerability in Adobe Connect versions 12.9 and earlier could let them execute malicious scripts right in your browser. 🔥 Think of it like a restaurant where a waiter delivers a menu with a hidden note that allows them to change your order without you noticing. If you're not careful, they could serve you something completely different, compromising your dining experience! If exploited, an attacker could hijack your session and gain access to sensitive information, altering the integrity of your session. This means they could impersonate you, access confidential data, or even cause chaos in your workspace! This is absolutely devastating for user trust.

Put simply

Think of it like a restaurant where a waiter delivers a menu with a hidden note that allows them to change your order without you noticing. If you're not careful, they could serve you something completely different, compromising your dining experience! This vulnerability allows high-privileged attackers to execute malicious scripts in a victim's browser after they navigate to a carefully crafted web page. The attack relies on the lack of proper validation in the DOM, enabling script injection.

What to do

If exploited, an attacker could hijack your session and gain access to sensitive information, altering the integrity of your session. This means they could impersonate you, access confidential data, or even cause chaos in your workspace! This is absolutely devastating for user trust. To safeguard against this vulnerability, update Adobe Connect to the latest version immediately. Educate users about potential phishing attempts and encourage vigilance when clicking on links. Regularly review permissions for high-privileged users to minimize risks. You've got this! With these steps, you can secure your Adobe Connect environment and protect your sessions like a true security hero! 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00388 · 31.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-15T02:15Z
Affected products (1)
ProductVersionsFixed in
adobe/connect< 12.1012.10
References (1)
EPSS history
Timeline
  • 14 OCT 21:53Z
    Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)
    cvelistv5