DOM-Based Cross-Site Scripting Vulnerability in Adobe Experience Manager

CVE-2025-64550

What is CVE-2025-64550?

Adobe Experience Manager versions 6.5.23 and earlier are susceptible to a DOM-based Cross-Site Scripting (XSS) vulnerability. A low-privileged attacker can exploit this flaw to execute arbitrary scripts in the user’s browser context. Successfully exploiting this vulnerability requires user interaction, such as clicking on a specially crafted URL or interacting with a compromised webpage. This poses a serious risk as it could lead to unauthorized actions being performed on behalf of the user.

References