Adobe Experience Manager versions 6.5.23 and earlier are vulnerable to a stored Cross‑Site Scripting (XSS) flaw that allows a low‑privileged attacker to inject malicious JavaScript into vulnerable form fields. The injected script may be executed in the victim’s browser when the affected page is viewed. Based on the description, it is inferred that such execution could potentially be used for phishing, data theft or other malicious actions, though the exact scope of impact is not specified in the CVE notice.

The affected products include Adobe Experience Manager 6.5.23 and all earlier releases, including the service pack 1 build and the cloud service variant. This is reflected by the CPE entries: cpe:2.3:a:adobe:experience_manager:6.5:sp1:*:*:lts:*:* cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:* cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*

The CVSS score of 5.4 indicates a moderate severity vulnerability. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is inferred to be a low‑privileged attacker submitting malicious content through the vulnerable form field; no elevated privileges or special configuration are required to exploit this flaw.