Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low privileged attacker to execute malicious scripts in the context of the victim's browser. Exploitation of this issue requires user interaction, such as visiting a crafted URL or interacting with a manipulated web page.
Fix
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.4 · adobeNVD modified 2026-10-08 10:10
Affected (CPE criteria) 3
cpe:2.3:a:adobe:experience_manager:*:*:*:*:-:*:*:*cpe:2.3:a:adobe:experience_manager:*:*:*:*:aem_cloud_service:*:*:*cpe:2.3:a:adobe:experience_manager:6.5:-:*:*:lts:*:*:*