InfoSecBulletin Cybersecurity for mankind
On Tuesday, Adobe released security updates for 254 vulnerabilities in its software, mainly affecting Experience Manager (AEM). There are 254 flaws, 225 of which are in AEM, affecting AEM Cloud Service and earlier versions up to 6.5.22. These have been addressed in AEM Cloud Service Release 2025.5 and version 6.5.23.
“Successful exploitation of these vulnerabilities could result in arbitrary code execution, privilege escalation, and security feature bypass,” Adobe said in an advisory.
AMD discloses 4 new CPU flaws Affecting Many CPUs
GitLab patched XSS and Authorization Bypass Flaws
CVE-2025-7206
Critical D-Link DIR-825 Router Flaw Remote Crash Via Buffer Overflow
Urgently patch now: Zoom Patches 6 Flaws
Whatsapp rival ‘Bitchat’, message without internet
Splunk Addresses Third-Party Package Vulns in SOAR Versions
Texas-based Tax Credit Consultancy agency exposed PII, ID Numbers, & SSNs
CVE-2025-25257
Fortinet Addresses Major SQL Injection Flaw in FortiWeb
Microsoft July 2025 Patch Tuesday: One zero-day, 137 flaws
Android malware Anatsa infiltrates Google Play targeting banks worldwide
Nearly all 225 vulnerabilities are identified as cross-site scripting (XSS), consisting of stored XSS and DOM-based XSS, enabling potential arbitrary code execution.
Adobe has acknowledged Jim Green (green-jam), Akshay Sharma (anonymous_blackzero), and lpi for discovering XSS flaws.
The key flaw resolved in this month’s update is a code execution issue in Adobe Commerce and Magento Open Source.
CVE-2025-47110, scoring 9.1, is a critical reflected XSS vulnerability that can lead to arbitrary code execution. There’s also CVE-2025-43585 with a score of 8.2, an improper authorization issue that might result in a security bypass.
The following versions are impacted:
Adobe Commerce (2.4.8, 2.4.7-p5 and earlier, 2.4.6-p10 and earlier, 2.4.5-p12 and earlier, and 2.4.4-p13 and earlier)
Adobe Commerce B2B (1.5.2 and earlier, 1.4.2-p5 and earlier, 1.3.5-p10 and earlier, 1.3.4-p12 and earlier, and 1.3.3-p13 and earlier)
Magento Open Source (2.4.8, 2.4.7-p5 and earlier, 2.4.6-p10 and earlier, 2.4.5-p12 and earlier)
The remaining updates include four that fix code execution issues in Adobe InCopy (CVE-2025-30327, CVE-2025-47107, CVSS scores: 7.8) and in Substance 3D Sampler (CVE-2025-43581, CVE-2025-43588, CVSS scores: 7.8).
None of the bugs are publicly known or exploited, but users should update to the latest version for safety.
