Adobe Experience Manager is vulnerable to a DOM‑based cross‑site scripting flaw that enables an attacker to inject and execute malicious JavaScript inside the victim’s browser. The flaw can be triggered when a user visits a specially crafted webpage; the attacker can then run arbitrary code in the context of the victim’s session, potentially allowing cookie theft, session hijacking, or phishing. The reported scope change indicates that the vulnerability may affect more than a single user or site, but it remains a client‑side code execution issue.

All installations of Adobe Experience Manager 6.5 are affected, regardless of customizations or deployment environment. No specific patch version information is provided beyond the 6.5 baseline, so all current instances should be treated as vulnerable until a new release is applied.

The CVSS score of 5.4 classifies the vulnerability as moderate. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, suggesting limited public exploitation data. Because exploitation requires user interaction to visit a malicious page, the likelihood of widespread attacks is moderate but not negligible.