The vulnerability is a stored Cross‑Site Scripting flaw that allows a low‑privileged attacker to inject malicious JavaScript into specific form fields which are persisted in Adobe Experience Manager 6.5 and 6.5 LTS. When a victim displays the page containing the stored input, the malicious script executes in the victim’s browser. This is a classic CWE‑79 flaw with a CVSS score of 5.4, indicating moderate severity.

Adobe Experience Manager version 6.5 and the 6.5 LTS release are affected.

The CVSS score of 5.4 reflects a moderate threat, and the EPSS score is not published, so the likelihood of exploitation remains uncertain. The flaw is not listed in CISA’s KEV catalog. Because the vulnerability resides in a web‑accessible form, the likely attack vector is remote via standard HTTP requests to the application by a low‑privileged user. An attacker must submit crafted input to the vulnerable field, which the application stores; any standard user browsing the resulting page will have the injected script executed.