Adobe Experience Manager is vulnerable to a DOM-based Cross‑Site Scripting flaw, allowing an attacker to embed and execute malicious JavaScript in a victim’s browser by manipulating the Document Object Model. The flaw enables the attacker to run arbitrary code in the context of the page, potentially leading to data theft, session hijacking, or defacement when the victim visits a crafted URL. The vulnerability is considered to have a changed scope, meaning that its exploitation can affect the system beyond its original confines.

Adobe Experience Manager version 6.5 is affected. The issue is listed under Adobe:Adobe Experience Manager 6.5.

The CVSS score for this vulnerability is 5.4, indicating a moderate risk. EPSS data is not available, so the current probability of exploitation cannot be precisely quantified. The vulnerability is not included in the CISA KEV catalog. Exploitation requires the victim to visit a crafted webpage, making it a user‑interaction based risk. Attackers would route users to malicious sites or phishing pages that contain the injected DOM manipulation to trigger the XSS payload.