Adobe Experience Manager versions 6.5.23 and earlier contain a stored cross-site scripting vulnerability. A low-privileged attacker could insert malicious JavaScript into certain form fields that are stored and later rendered on a page. When a user visits that page, the injected script runs in the victim's browser, allowing the attacker to affect client-side execution.

Affected systems include all Adobe Experience Manager 6.5 releases up to and including 6.5.23, as well as the SP1 update for 6.5. The CPE entries in the CVE list also cover the 6.5 base and sp1 packages; any release newer than 6.5.23 is presumed not to contain the flaw.

The CVE has a CVSS score of 5.4, indicating moderate severity. The EPSS score is below 1%, so public exploitation is considered unlikely at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only low privilege to submit data to a vulnerable form field, which is then stored and later displayed, making the attack vector straightforward for a user with limited access rights.