Adobe Experience Manager 6.5 contains a DOM‑based Cross‑Site Scripting flaw. An attacker can manipulate the document object model environment to inject malicious JavaScript that will execute in a victim’s browser when the user visits a crafted page. The vulnerability requires user interaction; no exploitation is possible without the victim opening the malicious content.

The only product identified as vulnerable is Adobe Experience Manager 6.5. All installations of this version are impacted unless the vendor patch is applied; no other versions or products are listed as affected.

The CVSS score of 5.4 indicates medium severity. The EPSS score is not available, so the exact exploitation probability is unknown. The vulnerability is not included in the CISA KEV catalog, implying no publicly known exploits at the time of this advisory. Exploitation requires a victim to visit a crafted webpage, reducing the likelihood of widespread attacks but allowing client‑side script execution for any user who follows a malicious link.