Vulnerability DatabaseCVE-2025-46894

CVE-2025-46894:
Adobe Experience Manager vulnerability analysis and mitigation

Overview

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2025-46894. The vulnerability was initially discovered and reported to Adobe Systems Incorporated, with the CVE record being published on June 10, 2025. This security flaw could be exploited by attackers with low privileges to inject malicious scripts into vulnerable form fields (NVD, CVE).

Technical details

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). It has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This scoring indicates network accessibility, low attack complexity, required low privileges, necessary user interaction, and potential for both confidentiality and integrity impacts (NVD, Wiz).

Impact

When successfully exploited, this vulnerability enables attackers to inject malicious scripts into vulnerable form fields. The malicious JavaScript code executes in victims' browsers when they navigate to pages containing the compromised fields, potentially leading to unauthorized data access or manipulation (Wiz).

Mitigation and workarounds

Adobe has addressed this vulnerability in versions after 6.5.22. Users are strongly advised to upgrade their Adobe Experience Manager installations to the latest version to mitigate this security risk (Wiz).