PT-2025-36780 · Adobe · Experience Manager

Published 2025-09-09 · Updated 2025-09-27 · CVE-2025-54251

Positive Technologies · (AI Summary)

CVSS v3.1

4.3

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

**Name of the Vulnerable Software and Affected Versions**

Adobe Experience Manager versions 6.5.23.0 and earlier

**Description**

The issue concerns an XML Injection flaw in Adobe Experience Manager. Exploitation may allow a remote attacker to bypass security features and gain unauthorized write access. The attacker requires low privileges to manipulate XML queries.

**Recommendations**

Update Adobe Experience Manager to a version later than 6.5.23.0.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

BDU:2025-11066

CVE-2025-54251

Affected Products

Experience Manager

References · 8

• https://bdu.fstec.ru/vul/2025-11066 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-54251 · Security Note
• https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html · Vendor Advisory
• https://twitter.com/CVEnew/status/1965557771362767307 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54251 · Note
• https://twitter.com/ITSecurityguard/status/1971127643715272730 · Twitter Post
• https://t.me/cveNotify/135249 · Telegram Post
• https://reddit.com/r/CVEWatch/comments/1nrrggp/top_10_trending_cves_27092025 · Reddit Post