Adobe Experience Manager is affected by a reflected Cross‑Site Scripting vulnerability with changed scope. An attacker can inject malicious JavaScript into a crafted URL that, when opened by a victim, is executed in the victim’s browser context. The execution can lead to cookie theft, session hijacking, defacement, or other client‑side tampering, thereby compromising the confidentiality and integrity of user data during that session.

The vulnerability afflicts Adobe Experience Manager version 6.5 and its 6.5 LTS release. No additional sub‑versions are listed, so all instances of these releases should be considered at risk.

The CVSS score of 5.4 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred from the description: a low‑privileged attacker requires a victim to click a malicious URL, meaning social engineering or phishing campaigns could be used. Because scope is changed, the impact is limited to the victim’s browser session and does not permit server‑side code execution.