by Kastro
Paper/Archive/CVE-2025-49553

CVE-2025-49553

Adobe Adobe Connect — Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 45.1.451 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted web page. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Scope is changed.

Affected

ProductAffectedFixed inSource
Adobe Connect≤ 12.9–CNA

Scores by source

adobe (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhelpx.adobe.com/security/products/connect/apsb25-70.html