A DOM-based XSS flaw in Adobe Experience Manager enables an attacker to execute malicious JavaScript within a victim’s browser, leveraging manipulation of the page’s DOM environment. The vulnerability is linked to CWE‑79 and permits arbitrary client‑side code execution when a user views a specially crafted page. The impact is confined to the victim’s session context and does not natively affect server‑side data or other users but can lead to phishing, credential theft, or defacement.

The flaw affects all installations of Adobe Experience Manager 6.5, the 6.5 LTS release, and the Adobe Experience Manager as a Cloud Service offering. No narrower sub‑versions are specified; the vulnerability applies broadly to these product lines.

The CVSS base score of 5.4 places this issue in the moderate range, and the absence of an EPSS value means actual exploitation likelihood is unclear. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread attacks. The required user interaction—clicking or visiting a malicious page—suggests that an attacker must entice an end‑user to load the crafted content; the scope change may elevate the potential effect on the affected system’s security boundaries.