Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2025-64537: Adobe Experience Manager lets malicious script run in browsers
CVE-2025-64537 · published 10 months ago
Summary
Versions of Adobe Experience Manager up to 6.5.23 can be tricked into running code that an attacker places on a web page. If a user clicks a crafted link, the attacker could steal the user’s login session or change data they see. Update to the latest version of Adobe Experience Manager as soon as possible to stop this from happening.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| adobe | experience_manager |
< 6.5.24.0 < 2025.12.0 6.5 cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:* |
| adobe | adobe experience manager | <= 6.5.23 |
Original advisory text
Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by injecting malicious scripts into a web page that are executed in the context of the victim's browser. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Exploitation of this issue requires user interaction in that a victim must visit a crafted malicious page.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta