The version of Adobe Experience Manager installed on the remote host is prior to 6.5. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-115 advisory.

  - Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting     (XSS) vulnerability that could lead to arbitrary code execution. An attacker could exploit this     vulnerability by injecting malicious scripts into a web page that are executed in the context of the     victim's browser. A successful attacker can abuse this to achieve session takeover, increasing the     confidentiality and integrity impact as high. Exploitation of this issue requires user interaction in that     a victim must visit a crafted malicious page. (CVE-2025-64537, CVE-2025-64539)

  - Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS)     vulnerability that could be abused by a low privileged attacker to inject malicious scripts into     vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the     page containing the vulnerable field. (CVE-2025-64541, CVE-2025-64546, CVE-2025-64547, CVE-2025-64548,     CVE-2025-64549, CVE-2025-64553, CVE-2025-64554, CVE-2025-64555, CVE-2025-64556, CVE-2025-64557,     CVE-2025-64558, CVE-2025-64559, CVE-2025-64572, CVE-2025-64574, CVE-2025-64575, CVE-2025-64576,     CVE-2025-64577, CVE-2025-64578, CVE-2025-64579, CVE-2025-64580, CVE-2025-64581, CVE-2025-64582,     CVE-2025-64585, CVE-2025-64586, CVE-2025-64590, CVE-2025-64591, CVE-2025-64592, CVE-2025-64593,     CVE-2025-64594, CVE-2025-64596, CVE-2025-64597, CVE-2025-64598, CVE-2025-64599, CVE-2025-64600,     CVE-2025-64601, CVE-2025-64602, CVE-2025-64603, CVE-2025-64604, CVE-2025-64605, CVE-2025-64606,     CVE-2025-64607, CVE-2025-64609, CVE-2025-64611, CVE-2025-64612, CVE-2025-64614, CVE-2025-64615,     CVE-2025-64616, CVE-2025-64619, CVE-2025-64620, CVE-2025-64622, CVE-2025-64623, CVE-2025-64626,     CVE-2025-64627, CVE-2025-64789, CVE-2025-64790, CVE-2025-64791, CVE-2025-64792, CVE-2025-64793,     CVE-2025-64794, CVE-2025-64796, CVE-2025-64797, CVE-2025-64799, CVE-2025-64800, CVE-2025-64801,     CVE-2025-64802, CVE-2025-64803, CVE-2025-64804, CVE-2025-64808, CVE-2025-64814, CVE-2025-64817,     CVE-2025-64820, CVE-2025-64821, CVE-2025-64822, CVE-2025-64823, CVE-2025-64825, CVE-2025-64826,     CVE-2025-64827, CVE-2025-64829, CVE-2025-64833, CVE-2025-64839, CVE-2025-64840, CVE-2025-64841,     CVE-2025-64845, CVE-2025-64847, CVE-2025-64850, CVE-2025-64852, CVE-2025-64853, CVE-2025-64857,     CVE-2025-64858, CVE-2025-64861, CVE-2025-64863, CVE-2025-64869, CVE-2025-64873, CVE-2025-64875,     CVE-2025-64881)

  - Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting     (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in     the context of the victim's browser. Exploitation of this issue requires user interaction, such as     visiting a crafted URL or interacting with a manipulated web page. (CVE-2025-64543, CVE-2025-64544,     CVE-2025-64545, CVE-2025-64550, CVE-2025-64551, CVE-2025-64560, CVE-2025-64562, CVE-2025-64563,     CVE-2025-64564, CVE-2025-64565, CVE-2025-64569, CVE-2025-64583, CVE-2025-64887, CVE-2025-64888)

  - Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS)     vulnerability that could be abused by a high privileged attacker to inject malicious scripts into     vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the     page containing the vulnerable field. (CVE-2025-64872)

  - Cross-site Scripting (DOM-based XSS) (CWE-79) potentially leading to Arbitrary code execution     (CVE-2025-64542)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Plugins Search

critical