CVE-2025-49547: 
Adobe Experience Manager vulnerability analysis and mitigation

CVE-2025-49547 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Experience Manager (AEM) versions 11.4 and earlier. The vulnerability was discovered and disclosed on July 8, 2025, affecting the AEM Screens component. This security flaw could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields (NVD).

The vulnerability is classified as a stored Cross-Site Scripting (XSS) vulnerability that allows malicious JavaScript execution in a victim's browser when they browse to a page containing the vulnerable field. The CVSS v3.1 base score is 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, required low privileges, and user interaction (NVD).

When exploited, the vulnerability allows malicious JavaScript code execution in the victim's browser context, potentially leading to data theft, session hijacking, or other client-side attacks. The impact is considered moderate as it requires user interaction and low-level privileges to exploit (CIS Advisory).

Adobe has released a patch in Adobe Experience Manager (AEM) Screens AEM 6.5.22 Screens FP11.6 to address this vulnerability. Users are strongly advised to update to the latest version to mitigate the risk (ASEC).