CVE-2025-64622
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacke…
Published Dec 10, 2025 · updated Oct 14, 2026 · adobe experience manager
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Timeline
Detection, updates, and resolution for this record.
Dec 10, 2025 · NIST NVD
Detected
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Oct 14, 2026 · NIST NVD
Updated
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Affected
- cpe adobe/experience managerversion unspecified
- cpe adobe/experience manager6.5
Sources
- CVE.orgCVE-2025-64622
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-64622
30-day exploitation probability 0.2%
first.org - NIST NVDCVE-2025-64622
Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s bro
nvd.nist.gov