The version of Adobe Experience Manager installed on the remote host is prior to 6.5.23. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-48 advisory.

  - Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Authorization     vulnerability that could result in Privilege escalation. A low privileged attacker could leverage this     vulnerability to bypass security measures and gain unauthorized access. Exploitation of this issue     requires user interaction. A successful attacker can abuse this to achieve session takeover, increasing     the confidentiality and integrity impact as high. (CVE-2025-46840)

  - Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting     (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into     vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the     page containing the vulnerable field. A successful attacker can abuse this to achieve session takeover,     increasing the confidentiality and integrity impact as high. (CVE-2025-46837)

  - Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS)     vulnerability that could be abused by a low privileged attacker to inject malicious scripts into     vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the     page containing the vulnerable field. (CVE-2025-46838, CVE-2025-46841, CVE-2025-46842, CVE-2025-46843,     CVE-2025-46844, CVE-2025-46845, CVE-2025-46846, CVE-2025-46847, CVE-2025-46848, CVE-2025-46850,     CVE-2025-46851, CVE-2025-46853, CVE-2025-46854, CVE-2025-46855, CVE-2025-46858, CVE-2025-46859,     CVE-2025-46860, CVE-2025-46861, CVE-2025-46862, CVE-2025-46863, CVE-2025-46864, CVE-2025-46865,     CVE-2025-46866, CVE-2025-46870, CVE-2025-46871, CVE-2025-46872, CVE-2025-46873, CVE-2025-46876,     CVE-2025-46877, CVE-2025-46878, CVE-2025-46879, CVE-2025-46880, CVE-2025-46881, CVE-2025-46882,     CVE-2025-46883, CVE-2025-46885, CVE-2025-46886, CVE-2025-46887, CVE-2025-46888, CVE-2025-46890,     CVE-2025-46891, CVE-2025-46892, CVE-2025-46893, CVE-2025-46894, CVE-2025-46895, CVE-2025-46898,     CVE-2025-46899, CVE-2025-46900, CVE-2025-46901, CVE-2025-46902, CVE-2025-46903, CVE-2025-46904,     CVE-2025-46905, CVE-2025-46906, CVE-2025-46907, CVE-2025-46908, CVE-2025-46909, CVE-2025-46910,     CVE-2025-46912, CVE-2025-46914, CVE-2025-46915, CVE-2025-46916, CVE-2025-46917, CVE-2025-46918,     CVE-2025-46919, CVE-2025-46920, CVE-2025-46922, CVE-2025-46923, CVE-2025-46924, CVE-2025-46926,     CVE-2025-46927, CVE-2025-46929, CVE-2025-46930, CVE-2025-46931, CVE-2025-46933, CVE-2025-46934,     CVE-2025-46935, CVE-2025-46939, CVE-2025-46940, CVE-2025-46941, CVE-2025-46942, CVE-2025-46943,     CVE-2025-46944, CVE-2025-46945, CVE-2025-46946, CVE-2025-46947, CVE-2025-46950, CVE-2025-46953,     CVE-2025-46954, CVE-2025-46955, CVE-2025-46956, CVE-2025-46957, CVE-2025-46960, CVE-2025-46963,     CVE-2025-46964, CVE-2025-46965, CVE-2025-46966, CVE-2025-46967, CVE-2025-46968, CVE-2025-46970,     CVE-2025-46971, CVE-2025-46972, CVE-2025-46973, CVE-2025-46974, CVE-2025-46975, CVE-2025-46976,     CVE-2025-46977, CVE-2025-46978, CVE-2025-46979, CVE-2025-46981, CVE-2025-46982, CVE-2025-46983,     CVE-2025-46984, CVE-2025-46985, CVE-2025-46986, CVE-2025-46987, CVE-2025-46988, CVE-2025-46989,     CVE-2025-46990, CVE-2025-46991, CVE-2025-46992, CVE-2025-46995, CVE-2025-46997, CVE-2025-46999,     CVE-2025-47000, CVE-2025-47002, CVE-2025-47003, CVE-2025-47004, CVE-2025-47005, CVE-2025-47006,     CVE-2025-47007, CVE-2025-47008, CVE-2025-47010, CVE-2025-47011, CVE-2025-47012, CVE-2025-47013,     CVE-2025-47014, CVE-2025-47015, CVE-2025-47016, CVE-2025-47017, CVE-2025-47019, CVE-2025-47020,     CVE-2025-47021, CVE-2025-47022, CVE-2025-47025, CVE-2025-47026, CVE-2025-47027, CVE-2025-47029,     CVE-2025-47030, CVE-2025-47031, CVE-2025-47032, CVE-2025-47033, CVE-2025-47034, CVE-2025-47035,     CVE-2025-47036, CVE-2025-47037, CVE-2025-47038, CVE-2025-47039, CVE-2025-47040, CVE-2025-47041,     CVE-2025-47042, CVE-2025-47044, CVE-2025-47045, CVE-2025-47047, CVE-2025-47048, CVE-2025-47050,     CVE-2025-47051, CVE-2025-47052, CVE-2025-47055, CVE-2025-47056, CVE-2025-47057, CVE-2025-47060,     CVE-2025-47062, CVE-2025-47063, CVE-2025-47065, CVE-2025-47066, CVE-2025-47067, CVE-2025-47068,     CVE-2025-47069, CVE-2025-47070, CVE-2025-47071, CVE-2025-47072, CVE-2025-47073, CVE-2025-47074,     CVE-2025-47075, CVE-2025-47076, CVE-2025-47077, CVE-2025-47078, CVE-2025-47079, CVE-2025-47080,     CVE-2025-47081, CVE-2025-47082, CVE-2025-47083, CVE-2025-47084, CVE-2025-47085, CVE-2025-47086,     CVE-2025-47087, CVE-2025-47088, CVE-2025-47089, CVE-2025-47090, CVE-2025-47091, CVE-2025-47092,     CVE-2025-47093, CVE-2025-47113, CVE-2025-47114, CVE-2025-47115, CVE-2025-47116, CVE-2025-47117)

  - Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting     (XSS) vulnerability. If a low privileged attacker is able to convince a victim to visit a URL referencing     a vulnerable page, malicious JavaScript content may be executed within the context of the victim's     browser. (CVE-2025-46857, CVE-2025-46874, CVE-2025-46875)

  - Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS)     vulnerability that could be abused by a high privileged attacker to inject malicious scripts into     vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the     page containing the vulnerable field. (CVE-2025-46884, CVE-2025-46911, CVE-2025-46913)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Adobe Experience Manager 6.5.0 < 6.5.23 Multiple Vulnerabilities (APSB25-48)

high Nessus Plugin ID 238053

Version 1.4

Version 1.3

Version 1.1

Version 1.4 Aug 26, 2025, 5:34 PM Plugin categorization (removed Agent attribute) Plugin Feed: 202508261734
Version 1.3 Jun 14, 2025, 3:22 AM IAVM reference STIG Severity (set to "I") Plugin Feed: 202506140322
Version 1.1 Jun 11, 2025, 2:37 AM New Plugin Feed: 202506110237