A DOM‑based Cross‑Site Scripting flaw exists in Adobe Experience Manager that allows an attacker to exploit the client‑side DOM environment and run malicious JavaScript in the victim’s browser. The vulnerability requires the victim to visit a crafted web page, after which the attacker can execute code with the same privileges as the compromised user, potentially leading to session hijacking, defacement, or phishing attempts. The flaw is classified as CWE‑79 and is noted to have a changed scope, indicating that successful exploitation could elevate privileges within the application context.

Adobe Experience Manager 6.5 and Adobe Experience Manager 6.5 LTS are impacted. No specific sub‑versions are listed, so any deployment of these product lines should be reviewed for the presence of the vulnerability.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation at this time. The attack vector is user‑initiated, requiring the victim to open a maliciously crafted page, after which the DOM manipulation permits code execution. Given the scope change, an attacker may achieve elevated privileges within the application, increasing the potential impact on confidentiality and integrity.