This vulnerability is an Improper Neutralization of Special Elements used in an SQL Command, which allows a low‑privileged attacker to inject crafted SQL into the application without user interaction. By exploiting this flaw, an attacker can bypass security controls and obtain unauthorized read access and limited write capabilities to the underlying data store.

Adobe Experience Manager 6.5 is the affected product; any deployment relying on this version is vulnerable. The flaw is present in the code that processes user inputs for database queries, enabling an attacker with limited privileges to perform unauthorized operations.

The CVSS score of 7.1 indicates moderate‑to‑high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, but the remote nature of the attack and the significant impact on confidentiality and integrity raise the risk profile. A likely attack vector is through the web interface, where an attacker can inject malicious SQL via crafted requests without needing additional user interaction.