Adobe Experience Manager is vulnerable to a stored cross‑site scripting flaw that allows a low‑privileged attacker to inject malicious JavaScript into form fields. When a victim visits the page containing the affected field, the injected script runs in the victim’s browser, potentially enabling session hijacking, defacement, or phishing. The vulnerability’s scope is changed, suggesting it could affect more than the initially intended domains or user scopes if exploited.

Adobe Experience Manager 6.5 is affected. Additional version details are not provided. Any installation of this product that includes the vulnerable form handling component is at risk.

The CVSS score of 5.4 indicates a medium severity. No EPSS score is available, and the vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is a remote attacker submitting a crafted payload through a publicly accessible form. Because the scope is changed, successful exploitation could lead to privilege escalation within the application’s context.