CVE-2025-47069: 
Adobe Experience Manager vulnerability analysis and mitigation

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2025-47069, which was disclosed on June 10, 2025. The vulnerability affects the form field functionality of the Adobe Experience Manager platform (NVD, CVE).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) issue (CWE-79) with a CVSS v3.1 base score of 5.4 (Medium). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating that the vulnerability requires network access, has low attack complexity, requires low privileges, and user interaction, with impacts to confidentiality and integrity but not availability (NVD, Wiz).

When successfully exploited, the vulnerability enables malicious JavaScript execution in a victim's browser when they access a page containing the compromised form field. The attack requires low privileges to execute, making it accessible to attackers with basic access to the system (NVD).

Adobe has released version 6.5.23.0 to address this vulnerability. Users are advised to upgrade their Adobe Experience Manager installations to this version or later (NVD).