This vulnerability is a DOM‑based Cross‑Site Scripting flaw in Adobe Experience Manager 6.5. By supplying a specially crafted URL or query string, an attacker can manipulate the Document Object Model in the victim’s web browser so that arbitrary JavaScript runs with the same privileges as the user. An attacker who succeeds could steal session cookies, deface the site, or steal sensitive data from the logged‑in user. The flaw is a typical example of the weakness identified by CWE‑79.

The flaw applies to Adobe Experience Manager 6.5, as published by Adobe. No other versions are known to be affected. All installations that serve web content from this product are potentially vulnerable if the DOM environment is exposed to external input values that are not properly sanitized.

The CVSS score of 5.4 indicates moderate severity, and the vulnerability requires the victim to click a crafted link or visit a malicious page. The EPSS score is not available but the lack of KEV listing suggests no widespread exploitation has been observed yet. However, because the flaw allows code execution in the browser context and the scope is changed, a credential‑oriented attack could be escalated if the victim is logged in as a privileged user, so the risk remains significant for organizations that rely on Adobe Experience Manager. An attacker would need only a simple social engineering technique to lure the victim to the page; no special prerequisites are described beyond a web‑browser client.