Critical · published December 11, 2025
🚨 A crafty attacker can unleash chaos by injecting malicious scripts into Adobe Experience Manager, putting your users at risk! 🔥 Think of this vulnerability like a sneaky magician performing tricks right in front of an unsuspecting audience. Just like a magician can manipulate perception, an attacker can inject scripts that fool the victim's browser into executing harmful commands without anyone realizing it. If exploited, an attacker could fully take over a user's session, accessing sensitive data and compromising user trust. This could lead to devastating breaches, where confidential information is exposed, making this vulnerability a serious threat to both integrity and confidentiality.
Think of this vulnerability like a sneaky magician performing tricks right in front of an unsuspecting audience. Just like a magician can manipulate perception, an attacker can inject scripts that fool the victim's browser into executing harmful commands without anyone realizing it. This DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager allows attackers to execute arbitrary code by injecting malicious scripts into web pages that run in the context of victims' browsers.
If exploited, an attacker could fully take over a user's session, accessing sensitive data and compromising user trust. This could lead to devastating breaches, where confidential information is exposed, making this vulnerability a serious threat to both integrity and confidentiality. Update Adobe Experience Manager to version 6.5.24 or later immediately. Additionally, educate your users about the importance of avoiding suspicious links and implement content security policies to mitigate attack vectors. You've got this! With the right updates and user awareness, you'll keep your web applications safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| adobe/experience_manager | < 6.5.24.0 | 6.5.24.0 |
| adobe/experience_manager | < 2025.12.0 | 2025.12.0 |
| adobe/experience_manager | all versions | — |