CVE-2025-46997: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability was discovered and initially recorded on April 30, 2025, with the CVE being published to the National Vulnerability Database on June 10, 2025 (NVD, CVE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). It has received a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, user interaction required, and potential for confidentiality and integrity impacts (NVD, Wiz).

The vulnerability enables attackers to inject malicious scripts into vulnerable form fields within Adobe Experience Manager. When users navigate to pages containing the compromised fields, malicious JavaScript code can be executed in their browsers, potentially leading to unauthorized data access or manipulation (Wiz).

Adobe has addressed this vulnerability in versions after 6.5.22. Organizations are advised to update their Adobe Experience Manager installations to the latest version to mitigate this security risk (Wiz).