The vulnerability allows an attacker with limited privileges to insert malicious scripts into form fields that are stored and later rendered when other users view the affected page. The stored payload is executed in the victim’s browser, enabling the attacker to steal data, hijack sessions, or perform further client‑side attacks. The CVE notes that the vulnerability changes the scope, implying that the impact can be broader than the attacker’s direct privileges.

Adobe Experience Manager 6.5 and the 6.5 LTS edition are affected. No specific sub‑versions are listed; the vulnerability applies to any installation of the named products that has not applied the available security update.

The CVSS score of 5.4 indicates moderate severity. Exploitation requires the attacker to be able to submit data to a vulnerable field, which can be done through normal user interfaces. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited documented exploitation to date. The likely attack vector is via the web application’s form inputs and the prerequisite is that the victim must visit the page containing the stored payload.