Adobe Experience Manager is vulnerable to a DOM‑based cross‑site scripting attack that allows an attacker to inject and execute malicious JavaScript in the victim’s browser. The weakness, identified as CWE‑79, occurs when untrusted data is incorporated into the DOM environment, enabling an attacker to run code that operates with the victim’s privileges. This flaw can compromise confidentiality, integrity, or availability by allowing the attacker to steal session data, deface the site, or redirect the victim to malicious content.

The issue affects Adobe Experience Manager version 6.5 and Adobe Experience Manager 6.5 LTS. Users running these releases are at risk unless a fix is deployed.

The documented CVSS base score is 5.4, indicating moderate severity. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. Exploitation requires user interaction; a victim must visit a crafted webpage that manipulates the DOM. The risk is elevated because any user who accesses an affected page can be targeted, but without a public exploit, the threat remains moderate.