Zetlyn
GitHubGet started

Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be expl…

cve CVE-2025-64887 1 source, 1 claim · Watch

NVD writes:
Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page. the claim
Severity
MEDIUM NVD
CVSS
5.4 NVD
Vendor
Adobe NVD
Product
Adobe Experience Manager NVD
CWE
CWE-79 NVD

How far exploitation has got

  1. No public code known
  2. Proof of concept
  3. Proof of concept, verified
  4. A Metasploit module
  5. Exploited in the wild
  6. Used in ransomware campaigns

Timeline

2025-12-10first spoke of it: Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.NVD

Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.

What it is to other things

affectsadobe/experience_manager
NVD
made_byadobe
NVD

In words only, so not counted until a person confirms one:

affectsadobe/adobe_experience_manager
NVD says “Adobe · Adobe Experience Manager”
Every value, with what each source said and its receipt
PropertySourceSaidMeans here
Automatable
automatable
NVDno
At least one of those steps needs a person.
receipt
Source
NVD
Its words
no
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCno
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Adobe Experience Manager",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "6.5.23",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0FC0CE20-2AC2-45FB-A7CF-9ADEEBC8B411",
                "versionEndExcluding": "6.5.24.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
                "matchCriteriaId": "3326AB8A-7DF7-437C-86B6-58BA768E42E5",
                "versionEndExcluding": "2025.12.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
                "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page."
      },
      {
        "lang": "es",
        "value": "Las versiones 6.5.23 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con pocos privilegios para ejecutar scripts maliciosos en el contexto del navegador de la víctima. La explotación de este problema requiere interacción del usuario, como visitar una URL manipulada o interactuar con una página web manipulada."
      }
    ],
    "id": "CVE-2025-64887",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-64887",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T20:56:32.076936Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T19:16:34.627",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS
cvss
NVD5.4
receipt
Source
NVD
Its words
5.4
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-09-29 09:45 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Adobe Experience Manager",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "6.5.23",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0FC0CE20-2AC2-45FB-A7CF-9ADEEBC8B411",
                "versionEndExcluding": "6.5.24.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
                "matchCriteriaId": "3326AB8A-7DF7-437C-86B6-58BA768E42E5",
                "versionEndExcluding": "2025.12.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
                "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page."
      },
      {
        "lang": "es",
        "value": "Las versiones 6.5.23 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con pocos privilegios para ejecutar scripts maliciosos en el contexto del navegador de la víctima. La explotación de este problema requiere interacción del usuario, como visitar una URL manipulada o interactuar con una página web manipulada."
      }
    ],
    "id": "CVE-2025-64887",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-64887",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T20:56:32.076936Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T19:16:34.627",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CVSS vector
cvss_vector
NVDCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
receipt
Source
NVD
Its words
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Adobe Experience Manager",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "6.5.23",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0FC0CE20-2AC2-45FB-A7CF-9ADEEBC8B411",
                "versionEndExcluding": "6.5.24.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
                "matchCriteriaId": "3326AB8A-7DF7-437C-86B6-58BA768E42E5",
                "versionEndExcluding": "2025.12.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
                "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page."
      },
      {
        "lang": "es",
        "value": "Las versiones 6.5.23 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con pocos privilegios para ejecutar scripts maliciosos en el contexto del navegador de la víctima. La explotación de este problema requiere interacción del usuario, como visitar una URL manipulada o interactuar con una página web manipulada."
      }
    ],
    "id": "CVE-2025-64887",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-64887",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T20:56:32.076936Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T19:16:34.627",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CWE
cwe
NVDCWE-79
receipt
Source
NVD
Its words
CWE-79
Read by
field:cve.weaknesses[].description[].value
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCCWE-79
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Adobe Experience Manager",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "6.5.23",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0FC0CE20-2AC2-45FB-A7CF-9ADEEBC8B411",
                "versionEndExcluding": "6.5.24.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
                "matchCriteriaId": "3326AB8A-7DF7-437C-86B6-58BA768E42E5",
                "versionEndExcluding": "2025.12.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
                "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page."
      },
      {
        "lang": "es",
        "value": "Las versiones 6.5.23 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con pocos privilegios para ejecutar scripts maliciosos en el contexto del navegador de la víctima. La explotación de este problema requiere interacción del usuario, como visitar una URL manipulada o interactuar con una página web manipulada."
      }
    ],
    "id": "CVE-2025-64887",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-64887",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T20:56:32.076936Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T19:16:34.627",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Exploitation
exploitation
NVDnone
No evidence of exploitation, and no public proof of concept.
receipt
Source
NVD
Its words
none
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCnone
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Adobe Experience Manager",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "6.5.23",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0FC0CE20-2AC2-45FB-A7CF-9ADEEBC8B411",
                "versionEndExcluding": "6.5.24.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
                "matchCriteriaId": "3326AB8A-7DF7-437C-86B6-58BA768E42E5",
                "versionEndExcluding": "2025.12.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
                "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page."
      },
      {
        "lang": "es",
        "value": "Las versiones 6.5.23 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con pocos privilegios para ejecutar scripts maliciosos en el contexto del navegador de la víctima. La explotación de este problema requiere interacción del usuario, como visitar una URL manipulada o interactuar con una página web manipulada."
      }
    ],
    "id": "CVE-2025-64887",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-64887",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T20:56:32.076936Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T19:16:34.627",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Product
product
NVDAdobe Experience Manager
receipt
Source
NVD
Its words
Adobe Experience Manager
Read by
field:cve.affected[].affectedData[].product
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCAdobe Experience Manager
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Adobe Experience Manager",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "6.5.23",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0FC0CE20-2AC2-45FB-A7CF-9ADEEBC8B411",
                "versionEndExcluding": "6.5.24.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
                "matchCriteriaId": "3326AB8A-7DF7-437C-86B6-58BA768E42E5",
                "versionEndExcluding": "2025.12.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
                "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page."
      },
      {
        "lang": "es",
        "value": "Las versiones 6.5.23 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con pocos privilegios para ejecutar scripts maliciosos en el contexto del navegador de la víctima. La explotación de este problema requiere interacción del usuario, como visitar una URL manipulada o interactuar con una página web manipulada."
      }
    ],
    "id": "CVE-2025-64887",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-64887",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T20:56:32.076936Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T19:16:34.627",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Severity
severity
NVDMEDIUM
From 4.0 to 6.9.
receipt
Source
NVD
Its words
MEDIUM
Read by
field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCMEDIUM
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Adobe Experience Manager",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "6.5.23",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0FC0CE20-2AC2-45FB-A7CF-9ADEEBC8B411",
                "versionEndExcluding": "6.5.24.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
                "matchCriteriaId": "3326AB8A-7DF7-437C-86B6-58BA768E42E5",
                "versionEndExcluding": "2025.12.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
                "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page."
      },
      {
        "lang": "es",
        "value": "Las versiones 6.5.23 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con pocos privilegios para ejecutar scripts maliciosos en el contexto del navegador de la víctima. La explotación de este problema requiere interacción del usuario, como visitar una URL manipulada o interactuar con una página web manipulada."
      }
    ],
    "id": "CVE-2025-64887",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-64887",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T20:56:32.076936Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T19:16:34.627",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
medium
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-09-29 09:45 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Adobe Experience Manager",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "6.5.23",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0FC0CE20-2AC2-45FB-A7CF-9ADEEBC8B411",
                "versionEndExcluding": "6.5.24.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
                "matchCriteriaId": "3326AB8A-7DF7-437C-86B6-58BA768E42E5",
                "versionEndExcluding": "2025.12.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
                "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page."
      },
      {
        "lang": "es",
        "value": "Las versiones 6.5.23 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con pocos privilegios para ejecutar scripts maliciosos en el contexto del navegador de la víctima. La explotación de este problema requiere interacción del usuario, como visitar una URL manipulada o interactuar con una página web manipulada."
      }
    ],
    "id": "CVE-2025-64887",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-64887",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T20:56:32.076936Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T19:16:34.627",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Technical impact
technical_impact
NVDpartial
The attacker gains limited control, or limited information.
receipt
Source
NVD
Its words
partial
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since
2026-10-06 12:29 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 12:29 UTCpartial
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Adobe Experience Manager",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "6.5.23",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0FC0CE20-2AC2-45FB-A7CF-9ADEEBC8B411",
                "versionEndExcluding": "6.5.24.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
                "matchCriteriaId": "3326AB8A-7DF7-437C-86B6-58BA768E42E5",
                "versionEndExcluding": "2025.12.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
                "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page."
      },
      {
        "lang": "es",
        "value": "Las versiones 6.5.23 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con pocos privilegios para ejecutar scripts maliciosos en el contexto del navegador de la víctima. La explotación de este problema requiere interacción del usuario, como visitar una URL manipulada o interactuar con una página web manipulada."
      }
    ],
    "id": "CVE-2025-64887",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-64887",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T20:56:32.076936Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T19:16:34.627",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDAdobe
receipt
Source
NVD
Its words
Adobe
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCAdobe
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "affected",
            "product": "Adobe Experience Manager",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "6.5.23",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*",
                "matchCriteriaId": "0FC0CE20-2AC2-45FB-A7CF-9ADEEBC8B411",
                "versionEndExcluding": "6.5.24.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*",
                "matchCriteriaId": "3326AB8A-7DF7-437C-86B6-58BA768E42E5",
                "versionEndExcluding": "2025.12.0",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*",
                "matchCriteriaId": "852C2582-859F-40DB-96CF-E1274CEECC1F",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page."
      },
      {
        "lang": "es",
        "value": "Las versiones 6.5.23 y anteriores de Adobe Experience Manager están afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM que podría ser explotada por un atacante con pocos privilegios para ejecutar scripts maliciosos en el contexto del navegador de la víctima. La explotación de este problema requiere interacción del usuario, como visitar una URL manipulada o interactuar con una página web manipulada."
      }
    ],
    "id": "CVE-2025-64887",
    "lastModified": "2026-09-25T23:10:00.463",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-64887",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-12-10T20:56:32.076936Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-12-10T19:16:34.627",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-79"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Every claim, by kind

vulnerability

Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.
zetlyn/cve-nvd · 2025-12-10
automatable no cvss 5.4 cvss_vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N cwe CWE-79 exploitation none product Adobe Experience Manager severity MEDIUM status Analyzed technical_impact partial vendor Adobe source