CVE-2025-64538CWE-79cross-site-scripting

CVE-2025-64538

Critical · published December 11, 2025

CVSS v3.1
9.3
EPSS
1%
Percentile
49.8
In the wild
Unconfirmed
What it is

🚨 A crafty attacker can unleash chaos by injecting malicious scripts into Adobe Experience Manager, putting your users at risk! 🔥 Think of this vulnerability like a sneaky magician performing tricks right in front of an unsuspecting audience. Just like a magician can manipulate perception, an attacker can inject scripts that fool the victim's browser into executing harmful commands without anyone realizing it. If exploited, an attacker could fully take over a user's session, accessing sensitive data and compromising user trust. This could lead to devastating breaches, where confidential information is exposed, making this vulnerability a serious threat to both integrity and confidentiality.

Put simply

Think of this vulnerability like a sneaky magician performing tricks right in front of an unsuspecting audience. Just like a magician can manipulate perception, an attacker can inject scripts that fool the victim's browser into executing harmful commands without anyone realizing it. This DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager allows attackers to execute arbitrary code by injecting malicious scripts into web pages that run in the context of victims' browsers.

What to do

If exploited, an attacker could fully take over a user's session, accessing sensitive data and compromising user trust. This could lead to devastating breaches, where confidential information is exposed, making this vulnerability a serious threat to both integrity and confidentiality. Update Adobe Experience Manager to version 6.5.24 or later immediately. Additionally, educate your users about the importance of avoiding suspicious links and implement content security policies to mitigate attack vectors. You've got this! With the right updates and user awareness, you'll keep your web applications safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00636 · 49.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-11T00:16Z
Affected products (3)
ProductVersionsFixed in
adobe/experience_manager< 6.5.24.06.5.24.0
adobe/experience_manager< 2025.12.02025.12.0
adobe/experience_managerall versions—
References (1)
EPSS history
Timeline
  • 10 DEC 18:24Z
    Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
    cvelistv5