Adobe Experience Manager is affected by a DOM‑based XSS flaw that allows an attacker to manipulate the document object model and execute malicious JavaScript in the victim’s browser. The vulnerability can lead to theft of session data, defacement of web pages, or other malicious actions performed in the context of the user. The weakness is a typical input handling error identified as CWE‑79.

The affected product is Adobe Experience Manager version 6.5. No additional version detail is provided beyond the 6.5 release line.

The CVSS score of 5.4 indicates a medium‑severity flaw. The exploitation requires user interaction, specifically visiting a crafted web page, and the attack surface is limited to browsers that process the vulnerable component. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Because the scope is changed, an attacker could potentially affect a broader range of resources than initially anticipated, but the lack of a public exploit reduces immediate risk.