CVE-2025-47005: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager (AEM) versions 6.5.22 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2025-47005. The vulnerability was discovered and disclosed on April 30, 2025, with Adobe Systems Incorporated serving as the assigning CNA (CVE Details).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79). It has received a CVSS v3.1 Base Score of 5.4 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This scoring indicates that the vulnerability is network-accessible, requires low attack complexity, needs low privileges, requires user interaction, can change scope, and can impact both confidentiality and integrity at a low level, with no impact on availability (NVD).

The vulnerability allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When victims browse to a page containing the compromised field, malicious JavaScript code can be executed in their browser, potentially leading to unauthorized data access or manipulation (Wiz).

Users of Adobe Experience Manager should upgrade to versions newer than 6.5.22 to address this vulnerability. The issue has been acknowledged by Adobe and a fix has been provided through their security bulletin (Adobe Security).