Stored Cross-Site Scripting Vulnerability in Adobe Experience Manager
CVE-2025-46949

5.4MEDIUM

Key Information:

Vendor

Adobe
Status
Adobe Experience Manager
Vendor
CVE Published:
10 June 2025

What is CVE-2025-46949?

Adobe Experience Manager versions 6.5.22 and earlier are vulnerable to a stored Cross-Site Scripting (XSS) issue, allowing a low privileged attacker to inject harmful scripts into specific form fields. This flaw can lead to the execution of malicious JavaScript code in the browser of any user accessing the compromised page, posing significant risks to user data and session integrity. It highlights the importance of securing input fields to prevent unauthorized code execution in web applications.

Affected Version(s)

Adobe Experience Manager 0 <= 6.5.22

References

https://helpx.adobe.com/security/products/experience-mana...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.