Vulnerability · Published Sep 9, 2025 · Assigned by adobe
CVE-2025-54251Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)
Medium 4.3
In plain English
A medium-severity security flaw in Adobe Experience Manager from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)1.7%top 22.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei
Official description
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Adobe Experience Manager | 0 – through 6.5.23.0 |
Weakness: CWE-91 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N