CVE-2025-54251
MEDIUM EXPLOITED NUCLEIAdobe Experience Manager <6.5.23.0 - Code Injection
Title source: llmDescription
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.
Nuclei Templates (1)
Adobe Experience Manager ≤ 6.5.23.0 - XML Injection
MEDIUMVERIFIEDby DhiyaneshDK,assetnote
Shodan:
http.title:"aem sign in" || http.component:"adobe experience manager" || cpe:"cpe:2.3:a:adobe:experience_manager"
Scores
CVSS v3
4.3
EPSS
0.0837
EPSS Percentile
92.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Details
VulnCheck KEV
2025-10-28
CWE
CWE-91
Status
published
Products (3)
adobe/experience_manager
6.5 (2 CPE variants)
adobe/experience_manager
< 2025.8.0
adobe/experience_manager
< 6.5.23.0
Published
Sep 09, 2025
Tracked Since
Feb 18, 2026