Adobe Experience Manager is vulnerable to a stored Cross‑Site Scripting flaw that permits a low‑privileged attacker to inject malicious JavaScript into form fields. When an unsuspecting user views the page, the injected script executes in their browser, potentially stealing credentials or hijacking the session. The weakness is identified as CWE‑79, and the vulnerability changes scope, enabling impact on users beyond the attacker.

Adobe Experience Manager 6.5 and Adobe Experience Manager 6.5 LTS

The CVSS score of 5.4 indicates a moderate severity, and the EPSS score is not available, suggesting limited publicly observed exploitation. The vulnerability can be triggered by an attacker who can submit content to a vulnerable form field, which is then stored and served to other users. The XSS payload executes in the context of any user who visits the affected page, providing an attacker the ability to hijack sessions or perform phishing attacks. Since it is a stored flaw, persistence of the attack increases risk, and the absence of KEV listing means no known exploit has been widely reported.