CVE-2025-47060: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that was discovered and disclosed on June 10, 2025. The vulnerability could be exploited by attackers with low privileges to inject malicious scripts into vulnerable form fields (NVD, Wiz).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). It has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, user interaction requirement, and potential for limited confidentiality and integrity impacts (NVD, Wiz).

When successfully exploited, the vulnerability allows attackers to inject malicious scripts into vulnerable form fields. When victims browse to the page containing the compromised field, the malicious JavaScript code executes in their browser, potentially leading to unauthorized data access or manipulation (Wiz).

Adobe has addressed this vulnerability in versions after 6.5.22. Users are advised to update their Adobe Experience Manager installations to the latest version to mitigate this security risk (Wiz).