Adobe Experience Manager Forms XML External Entity Injection (CVE-2025-54254)

Tim Peck@timpeck

•updated Nov 10, 2025•0•20

This rule detects attempts to exploit an XML External Entity (XXE) injection vulnerability in Adobe Experience Manager Forms. The detection logic specifically looks for HTTP POST requests to the '/edcws/services/urn:EDCLicenseService' URI containing '<EDCSecurity>' and '<!ENTITY' patterns in the request body, along with a PCRE regex to identify the XXE payload structure.