CVE-2025-64838: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager as a Cloud Service

CVE-2025-64838 describes a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager as a Cloud Service. The flaw allows low-privileged attackers to inject malicious JavaScript into form fields, which is then executed in the browsers of users who visit the affected pages. The vulnerability impacts confidentiality and integrity but does not affect availability. The CVSS v3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and scope change.

Successful exploitation can lead to execution of arbitrary JavaScript in the context of the affected web application, potentially allowing attackers to steal sensitive information or perform actions on behalf of the victim user. The impact is limited to confidentiality and integrity with no direct availability impact.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is not a cloud-hosted service managed by the vendor, users should monitor Adobe's official advisories for updates and apply patches or mitigations once available.