Adobe Experience Manager has a stored Cross‑Site Scripting vulnerability that allows a low‑privileged attacker to embed malicious JavaScript in form fields. When another user views the page containing the altered field, the script executes in the victim’s browser, potentially stealing data or performing unauthorized actions. The flaw involves improper handling of user input and causes a change in scope, thereby elevating the potential impact beyond the original assignee to other system components.

Vulnerable versions include Adobe Experience Manager 6.5, the 6.5 LTS release, and the Adobe Experience Manager as a Cloud Service deployment. The issue is specific to these configurations, and any deployment that still runs these legacy versions or uses the legacy form functionality is susceptible.

CVE‑2025‑64830 carries a CVSS score of 5.4, which is considered moderate. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because exploitation requires a low‑privileged user to insert crafted data into a form, attackers need only legitimate access to submit input. Once the malicious code is stored, any user who accesses the affected page will have the script executed in their browser, signalling a moderate but actionable risk that should be addressed promptly.