CVE-2025-47011: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2025-47011, which was disclosed on June 10, 2025. The vulnerability affects the form field functionality of the application and could be exploited by attackers with low privileges (NVD, Wiz).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) with a CVSS v3.1 base score of 5.4 (Medium). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N indicates that the vulnerability requires network access, has low attack complexity, needs low privileges, and requires user interaction for successful exploitation (NVD).

When successfully exploited, the vulnerability enables malicious JavaScript execution in a victim's browser when they navigate to pages containing compromised form fields. The impact assessment shows low severity for both confidentiality and integrity aspects, with no impact on system availability (NVD, Wiz).

Adobe has addressed this vulnerability in versions after 6.5.22. Organizations are strongly advised to update to the latest version of Adobe Experience Manager to mitigate this security risk (Wiz).