Adobe Experience Manager 6.5 contains a DOM‑based Cross‑Site Scripting vulnerability that allows an attacker to execute malicious JavaScript within the context of a victim’s browser. The flaw can be triggered by manipulating the Document Object Model from a crafted page. When a user visits such a page, the attacker’s code runs in that user’s browser, potentially allowing data theft or session hijacking.

Adobe Experience Manager 6.5 is affected. The vulnerability is documented by Adobe and applies to installations of this version; no other versions were listed as affected.

The CVSS score of 5.4 indicates a medium severity impact. EPSS data is not available and the flaw is not listed in CISA’s KEV catalog. Exploitation requires user interaction: a victim must click or otherwise open a crafted webpage. The attack vector is likely a social‑engineering or phishing scenario that lures the user to the malicious page. The scope change indicates that the affected code runs in the context of the victim’s session, giving the attacker the same privileges as the user.