CVE-2025-54251

Published: Sep 9, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD (Secondary)

Description

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.

Affected (4)

Products: Adobe: Experience Manager

Adobe

1 product

Experience Manager

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Adobe Experience Manager	Up to 6.5.23.0
Adobe Experience Manager	Up to 2025.8.0
Adobe Experience Manager	Version 6.5
Adobe Experience Manager	Version 6.5 sp1

Related CWEs

CWE-91

XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References (1)

https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html

Source: psirt@adobe.com

Vendor Advisory

Timeline

No history available yet.