CVE-2025-64827

MEDIUM

Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts ...

Affects 1 product across 1 vendor.

CVSS 3.15.4
EPSS0.2%
Percentile10th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, requires user interaction, can impact systems beyond the vulnerable component, no availability impact.
CWE Weakness Definitions
CWE-79: Cross-Site Scripting (XSS)

Attacker injects malicious scripts into web pages viewed by other users, executing in the victim's browser context.

Related Attack Patterns (CAPEC)
CAPEC-85 AJAX Footprinting
via CWE-79
CAPEC-209 XSS Using MIME Type Mismatch
via CWE-79
CAPEC-588 DOM-Based XSS
via CWE-79
CAPEC-591 Reflected XSS
via CWE-79
CAPEC-592 Stored XSS
via CWE-79
Show all 6
via CWE-79

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

Adobe Experience Manager versions 6.5.23 and earlier are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability, allowing low-privileged attackers to inject malicious scripts into form fields, which can execute in a victim's browser.

BSID: BS-2025-GLOBAL-028049-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-64827?
Adobe Experience Manager versions 6.5.23 and earlier are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability, allowing low-privileged attackers to inject malicious scripts into form fields, which can execute in a victim's browser.
What is the CVSS score for CVE-2025-64827?
CVE-2025-64827 has CVSS 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS: 0.2%.
Is CVE-2025-64827 actively exploited?
No confirmed active exploitation of CVE-2025-64827 as of 2026-05-30.
How do I remediate CVE-2025-64827?
Priority: HIGH. Advisory: https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html PSIRT: [email protected]
What systems are affected by CVE-2025-64827?
CVE-2025-64827 affects Adobe Experience Manager.
Vulnerability Details
CVE IDCVE-2025-64827
BSIDBS-2025-GLOBAL-028049-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Published2025-12-10
Last Modified2025-12-12
ICS Relevance0%
Weakness (CWE)
Cross-Site Scripting (XSS)
SourceNVD
Official Description

Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper validation and sanitization of user input in form fields, enabling attackers to store malicious scripts that are then executed in the browser of any user who views the affected page.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Adobe Experience Manager < 2025.12.0
Remediation
View Vendor Advisory →

Remediation Priority: HIGH

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 309 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashfa23c2d01dab7f6e101088343f6bc443779ca459869ba5840d602d49339e1482f44f2bed3c847ba876d3b1abea79c270665fc8b40ecf2d459580c91ae9b715d6
Related CVEs affecting Adobe
CVE-2026-48331 10.0 Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SS... CVE-2012-1530 10.0 Heap-based buffer overflow in the XSLT engine in Adobe Reader and Acrobat 9.x... CVE-2012-0766 10.0 The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 ... CVE-2012-0772 10.0 An unspecified ActiveX control in Adobe Flash Player before 10.3.183.18 and 1... CVE-2026-48276 10.0 ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestrict...
View all Adobe CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →