CVE-2025-64537CWE-79cross-site-scripting

CVE-2025-64537

Critical · published December 11, 2025

CVSS v3.1
9.3
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

🚨 If you’re running Adobe Experience Manager 6.5.23 or earlier, you might just have a script-loving intruder waiting for an invite! Think of your browser as a restaurant where a thief slyly slips in a fake menu – when you order from it, they serve you a dish that steals your secrets instead of a tasty meal. This sneaky XSS vulnerability allows attackers to inject their own malicious scripts, turning your web experience into a trap! An attacker exploiting this vulnerability could gain the ability to execute arbitrary code in your browser, potentially taking over your session. This means they could access sensitive information, manipulate your actions, or even act on your behalf! The consequences could be absolutely devastating, putting your data and privacy at severe risk. 🔥

Put simply

Think of your browser as a restaurant where a thief slyly slips in a fake menu – when you order from it, they serve you a dish that steals your secrets instead of a tasty meal. This sneaky XSS vulnerability allows attackers to inject their own malicious scripts, turning your web experience into a trap! This DOM-based Cross-Site Scripting (XSS) flaw allows attackers to inject harmful scripts into web pages viewed by victims, exploiting the execution context of the browser to perform unauthorized actions.

What to do

An attacker exploiting this vulnerability could gain the ability to execute arbitrary code in your browser, potentially taking over your session. This means they could access sensitive information, manipulate your actions, or even act on your behalf! The consequences could be absolutely devastating, putting your data and privacy at severe risk. 🔥 Immediately update your Adobe Experience Manager to version 6.5.24 or later! Additionally, ensure robust content security policies are in place to mitigate any potential script injections. Regularly educate users about the dangers of clicking on suspicious links! You've got this! By following these steps, you can fortify your defenses and keep the bad actors at bay. 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00740 · 54.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-11T00:16Z
Affected products (3)
ProductVersionsFixed in
adobe/experience_manager< 6.5.24.06.5.24.0
adobe/experience_manager< 2025.12.02025.12.0
adobe/experience_managerall versions—
References (1)
EPSS history
Timeline
  • 10 DEC 18:24Z
    Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
    cvelistv5