Adobe Experience Manager versions 6.5.23 and earlier contain a stored Cross‑Site Scripting vulnerability (CWE‑79). A low‑privileged attacker can inject malicious JavaScript into vulnerable form fields, causing the script to execute in the browsers of any user who views the affected page, potentially leading to session hijacking or credential theft.

Adobe Experience Manager, specifically versions 6.5.23 and all earlier releases, across both on‑premises and cloud deployments.

The vulnerability has a CVSS v3 score of 5.4 (medium), an EPSS score of less than 1 % indicating low current exploit likelihood, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to submit crafted input into a vulnerable form, which is then stored and rendered, making the attack path straightforward once the malicious payload is accepted.