The vulnerability in Adobe Experience Manager is a DOM-based Cross‑Site Scripting flaw that allows an attacker to inject and execute JavaScript in a victim’s browser by manipulating the DOM. When the victim visits a crafted webpage, the malicious script runs in the context of the site, potentially enabling data theft, session hijacking, or phishing actions. The flaw is categorized as CWE‑79 and does not affect server‑side code, so the impact is confined to the compromised browser sessions.

Adobe Experience Manager, version 6.5 is affected. No other product versions are listed in the advisory. The vulnerability applies to all deployments of Experience Manager 6.5 until patched or mitigated.

The CVSS score of 5.4 classifies the risk as moderate, and the EPSS score is not available, indicating limited publicly reported exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires user interaction—an attacker must convince a user to open a maliciously crafted page. As such, the threat primarily impacts users who visit the affected web pages and does not affect the server infrastructure directly.