Adobe Experience Manager contains a DOM‑based Cross‑Site Scripting flaw that lets an attacker inject and run malicious JavaScript in the victim’s browser. The flaw requires a user to open a specially crafted webpage, and it can alter the Document Object Model on the client side to trigger execution of the attacker‑supplied code. Because the attack context runs in the victim’s browser, any client‑side data processed by the application could be compromised, and the reported scope change indicates that other components may be affected if the DOM manipulation succeeds.

Adobe Experience Manager 6.5, the 6.5 Long Term Support release, and the Experience Manager Cloud Service are affected. The advisory does not disclose specific affected minor or patch revisions; version details are not available.

The CVSS score of 5.4 denotes moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of active exploitation is uncertain. Exploitation demands user interaction with a malicious site, and the scope change means that successful exploitation could influence additional components beyond the original target component.