CVE-2025-64539

An attacker injects a malicious script into a web page, which is then executed in the context of the victim's browser (DOM-based XSS). The vulnerability mechanism relies on improper handling of input data on the client side — the script modifies the document object model (DOM) without proper sanitization. The attack requires user interaction: the victim must visit a specially crafted malicious page. After successful payload execution, the attacker can take over the user's active session.

Successful exploitation of the vulnerability allows an attacker to take over the session of a logged-in user (session takeover) and execute arbitrary code in the context of their browser, resulting in high risk to data confidentiality and integrity.

Apply patches available from the manufacturer according to the references — detailed information about patched versions is available in Adobe's security bulletin: https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html

Adobe Experience Manager in versions 6.5.23 and earlier.