Adobe Experience Manager is vulnerable to a DOM‑based Cross‑Site Scripting flaw that allows an attacker to inject and execute arbitrary JavaScript while a user views a crafted page. The weakness is a classic client‑side input handling issue (CWE‑79) and is further complicated by a scope change, meaning the attack can potentially affect components beyond the user's original session context. Successful exploitation would let the attacker hijack user sessions, exfiltrate data, or deface the web application, all within the victim’s browser environment.

Affected products include Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service. No specific patch version is listed, so any installation of those products without an updated security package is at risk.

The CVSS base score of 5.4 indicates a moderate severity. The EPSS value is not available, and the vulnerability is not on the CISA KEV list, suggesting a lower likelihood of widespread exploitation. However, the required user interaction (visiting a crafted page) means the vulnerability depends on social engineering or malicious URLs. Given the scope change, an attacker who succeeds can potentially target additional users or system components, raising the overall risk if the exploit is deployed.