Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows a low-privileged authenticated user to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who browses to the page rendering that content. Exploitation is a two-step chain requiring both a low-privileged account permitted to submit or edit content in the affected form field (PR:L) and a victim who views the resulting page (UI:R), so impact is confined to client-side script execution in the victim's session with no server-side code execution. This is a genuine but low-priority vulnerability: EPSS is only 0.25% (15th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, and the score is CVSS 5.4 with scope change but only low confidentiality and integrity impact.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious JavaScript into form fields, which then executes in the browser of a victim who visits the affected page. The attack requires a valid low-privileged account to persist the payload and a victim to interact with the crafted content, as reflected by the CVSS vector PR:L/UI:R. No public exploit identified at time of analysis, and the EPSS score is 0.25% (15th percentile), consistent with a genuine but low-priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM Cloud Service and the AEM 6.5 LTS branch - lets an attacker who already holds a low-privileged authenticated account inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who views the page rendering that field. Exploitation requires two conditions to line up: a valid low-privilege AEM login capable of writing to the affected field (PR:L), and a victim navigating to the poisoned page (UI:R), so there is no unauthenticated or zero-interaction path. Scoring is CVSS 5.4 with EPSS at 0.25% (15th percentile), and no public exploit identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS allows an authenticated, low-privileged user to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any other user who views the affected page. Successful exploitation requires an account on the AEM instance (CVSS PR:L) plus victim interaction (UI:R), and the scope change in the CVSS vector (S:C) reflects that the injected script runs in the victim's browser context rather than the vulnerable component's own security context. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is very low at 0.25% (15th percentile), making this a genuinely low-priority finding despite the network attack vector.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) 6.5.23 and earlier allows an authenticated attacker with low-privilege content-authoring access to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Exploitation requires the victim to interact with the crafted page (UI:R) and the attacker to have a valid low-privileged account (PR:L), so it is not unauthenticated or remote-exploitable without credentials. No public exploit code has been identified at time of analysis, and EPSS is low at 0.25%, making this a genuine but low-priority issue for most deployments.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page. Exploitation requires two independent gates as assessed: a valid low-privileged AEM account able to submit content into the vulnerable field (PR:L per the CVSS vector), and a separate victim who must browse to the page rendering that stored payload (UI:R), which substantially limits realistic risk despite the network attack vector. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.25% (15th percentile), so this is best treated as a persistent-but-conditional content-injection issue rather than an urgent, remotely exploitable flaw.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and the 6.5 LTS track) lets a low-privileged authoring user persist malicious JavaScript into form fields, which then executes in the browser of any user who later views the affected page. Exploitation is not remote and unauthenticated: per the CVSS vector PR:L the attacker must already hold an authenticated AEM account able to submit content into the vulnerable fields, and per UI:R a separate victim must browse to the page rendering that stored content, with impact confined to limited confidentiality and integrity loss in the victim's session (scope change S:C, no availability impact). Risk is low in practice - EPSS is 0.25% (15th percentile), the issue is not in CISA KEV, and no public exploit code was identified at time of analysis - although Adobe tracked it under its APSB25-115 security bulletin, so patched builds are available from the vendor.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets an attacker with a valid low-privileged account persist malicious JavaScript inside vulnerable form fields; the script then executes in the browser of any higher-privileged user who views the affected page. The author-input prerequisite (PR:L) and the requirement that a victim navigate to the poisoned page (UI:R) substantially limit practical impact, no server-side code execution or availability loss is possible, and no public exploit has been identified at time of analysis. EPSS is 0.25% (15th percentile), consistent with a low-likelihood, targeted-abuse scenario rather than mass exploitation.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier (including AEM Cloud Service and AEM 6.5 LTS) lets a low-privileged authenticated user persist malicious JavaScript into a vulnerable form field, which then executes in the browser of any victim who later views that page. The CVSS vector (PR:L/UI:R/S:C) confirms that the attacker must already hold a valid account with rights to submit or edit the affected form field, and that the payload only fires when a victim browses to the poisoned page - the injected script crosses into the victim's authenticated session (S:C) but yields only limited confidentiality and integrity impact (C:L/I:L) with no server-side code execution or availability loss. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is 0.25% (15th percentile), consistent with our assessment that this is a genuinely low-priority issue despite its network attack vector.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they visit the page containing the field. The vulnerability requires a valid low-privileged authoring account and a separate victim user to interact with the page, limiting its real-world impact; no public exploit has been identified at the time of analysis and the EPSS score is 0.25% (15th percentile).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and AEM 6.5 LTS, allows an authenticated low-privileged attacker to inject malicious JavaScript into vulnerable form fields; the script executes in a victim’s browser when that user browses to the page containing the injected field. Exploitation requires both a low-privileged AEM account (PR:L) and victim interaction (UI:R), and no public exploit has been identified at time of analysis. EPSS is 0.25% (15th percentile), consistent with a low-priority issue despite the network attack vector.
Stored cross-site scripting (XSS) in Adobe Experience Manager versions 6.5.23 and earlier, including AEM Cloud Service and 6.5 LTS, allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they view the compromised page. Exploitation requires a valid account with content-editing privileges and victim interaction, and no public exploit code or active exploitation has been identified, with a low EPSS score of 0.25% (15th percentile). The vulnerability is assessed as moderate severity (CVSS 5.4) and is not remotely exploitable against unauthenticated attackers.
Adobe Experience Manager 6.5.23 and earlier, including AEM Cloud Service and 6.5 LTS, is affected by a stored cross-site scripting (XSS) vulnerability that allows an authenticated low-privileged attacker to inject malicious JavaScript into form fields, which then executes in a victim's browser when they view the affected page. The risk is moderate (CVSS 5.4) with a low EPSS score of 0.25%, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service allows an authenticated low-privileged attacker - such as a content author or form editor - to inject malicious JavaScript into form fields. The injected script executes in the browser of any user who later views the poisoned page, potentially leading to session theft or other client-side attacks. No public exploit code has been identified at time of analysis, and the EPSS probability is low (0.25%, 15th percentile).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into form fields, which executes in a victim's browser when they view the affected page. Affected deployments include AEM 6.5 (including LTS) and AEM as a Cloud Service. Exploitation requires valid authoring credentials and victim interaction; no public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is 0.25% (15th percentile), indicating low predicted likelihood.
Stored cross-site scripting in Adobe Experience Manager (AEM) 6.5.23 and earlier, AEM Cloud Service, and AEM 6.5 LTS lets an authenticated low-privileged user inject malicious JavaScript into vulnerable form fields; the script is persisted and executes in the browser of any victim who later views the affected page. Exploitation is a two-step chain: an insider or attacker holding a compromised author/editor credential with write access to the form fields plants the payload (PR:L), and a separate victim must then navigate to that page for it to fire (UI:R), so the attacker cannot self-trigger impact. Risk is moderate - CVSS 5.4 (CWE-79), EPSS 0.25% at the 15th percentile, no CISA KEV listing, and no public exploit code identified at time of analysis; impact is confined to the victim's browser session with no server compromise or availability loss.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated author to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later browses to the page rendering that field. Exploitation requires an attacker to already hold a valid AEM account with authoring access plus a separate victim to load the poisoned page, so the attack is not unauthenticated and does not compromise the server itself - impact is limited to script execution in the victim's browser session (low confidentiality and integrity, no availability impact). No public exploit code has been identified at time of analysis, no active exploitation is confirmed, and the EPSS score is 0.25% (15th percentile), consistent with a moderate, non-priority issue that nonetheless matters in author-heavy or publicly exposed publish-tier deployments.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets an authenticated attacker with low privileges inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who opens the affected page. The attack is not remote-unauthenticated despite the AV:N vector: the CVSS vector (PR:L/UI:R/S:C) confirms the attacker must hold a valid low-privileged account with form/content authoring rights, and a separate victim must browse to the poisoned page, limiting impact to Low confidentiality and Low integrity within the victim's session with no availability effect. This is a moderate-severity issue (CVSS 5.4, CWE-79) whose real-world priority is low-to-moderate; no public exploit code has been identified at time of analysis, no active exploitation has been confirmed (not listed in CISA KEV), and EPSS is only 0.25% (15th percentile).
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into form fields, which then executes in the browser of any user who later views the affected page. Exploitation requires a valid AEM account with content-authoring privileges (PR:L) and a victim to browse to the compromised page (UI:R); CISA KEV does not list this CVE and no public exploit code was identified at time of analysis. With an EPSS score of 0.25% (15th percentile), the immediate exploitation likelihood is low, and given the medium severity (CVSS 5.4) and no availability impact, it should be patched in a normal maintenance cycle rather than as an emergency.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker with content-authoring write access to inject malicious scripts into form fields, which execute in a victim's browser when the page is viewed. The vulnerability requires a separate victim to browse the affected page and is rated moderate severity (CVSS 5.4) with a low EPSS of 0.25% (15th percentile). No public exploit code or active exploitation has been identified at the time of analysis; Adobe has published security bulletin APSB25-115 with remediation guidance.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) versions 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into form fields, which then executes in the browser of any user who later views the affected page. This is a moderate-severity, low-priority issue: exploitation requires an authenticated account with form-submission privileges and victim interaction, and the EPSS score is only 0.25% (15th percentile), indicating a low likelihood of exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM 6.5 LTS and AEM as a Cloud Service - allows an authenticated attacker holding only low-level privileges to inject malicious script into vulnerable form fields, which then executes in the browser of any user who later views the affected page. Exploitation requires two limiting preconditions that keep real-world risk moderate rather than urgent: a valid low-privileged authoring account (PR:L, so not anonymous/unauthenticated reachable) and victim interaction (UI:R) when the victim browses the poisoned field. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is a low 0.25% (15th percentile), consistent with a low-priority, moderate-severity issue; Adobe's advisory APSB25-115 covers the fix.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim’s browser when the victim views the affected page. Affected deployments include AEM 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service. Exploitation requires valid low-privileged credentials plus victim interaction (CVSS 3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code was identified at time of analysis; EPSS is 0.25% (15th percentile), indicating low observed exploitation likelihood.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including the 6.5 LTS line and AEM Cloud Service - lets an authenticated, low-privileged user inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who browses to the page rendering that field. Exploitation requires two conditions to be met simultaneously: a valid low-privileged AEM account with permission to submit or edit content (PR:L), and a victim subsequently visiting the affected page (UI:R), so the flaw is not reachable anonymously and does not self-propagate. The issue is rated CVSS 5.4 (S:C, C:L/I:L/A:N), EPSS is 0.25% (15th percentile), and there is no CISA KEV entry or public exploit code identified at time of analysis, making this a low operational priority rather than an urgent threat.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated, low-privileged user to inject malicious JavaScript into a vulnerable form field, which then executes in the browser of any victim who browses to the page rendering that stored content. Exploitation is not unauthenticated or drive-by: it requires an account able to write into the affected form field (PR:L) plus a separate victim who visits the page (UI:R), and because the CVSS scope is changed (S:C) the script runs with the privileges of the viewing user's AEM session. Overall risk is moderate rather than emergency - EPSS is only 0.25% (15th percentile), no public exploit code was identified at time of analysis, and there is no CISA KEV listing, though Adobe has published advisory apsb25-115 covering the fix.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service lets an authenticated attacker with only low privileges inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any victim who views the poisoned page (CVSS 5.4, vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Exploitation is not remote-unauthenticated: the attacker needs a content-authoring or form-submission foothold (PR:L), the payload must survive any sanitization in the affected form workflow, and a separate victim must load the affected page for the script to fire (UI:R), with scope change allowing the script to act in the victim's session context. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, with a low EPSS score of 0.25% (15th percentile) indicating limited near-term exploitation likelihood; Adobe's advisory APSB25-115 documents the fix. This is a genuine but moderate-priority issue rather than a top-tier emergency, since impact is bounded by the need for an existing low-privileged account plus victim interaction.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which executes in a victim's browser when they view the affected page. This moderate-severity flaw (CVSS 5.4) requires the attacker to have a low-privileged account and the victim to interact with the page, limiting its exploitability; no public exploit code has been identified and EPSS is low (0.25%).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged user to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when the victim views the affected page. Exploitation is not self-triggering: the attacker must already have content/form-editing privileges, and a victim must subsequently browse to the poisoned page, with impact limited to low confidentiality and integrity and no availability effect. No public exploit identified at time of analysis; EPSS is 0.25% (15th percentile), indicating low predicted exploitation activity.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including the 6.5 LTS line and AEM as a Cloud Service per the affected CPE set - allows a low-privileged authenticated author to persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who loads the page rendering that field. Exploitation requires both a valid low-privileged AEM account with content-write access (PR:L) and a victim who browses the poisoned page (UI:R), so the payload never fires on its own, and impact is confined to the victim's browser session with Low confidentiality and integrity effects (no availability impact, no direct server compromise). There is no evidence of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.25% (15th percentile), consistent with a genuinely moderate-risk issue that should not be prioritized as a critical emergency.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged but authenticated user - an author, form editor, or content contributor able to write into form fields - to persist malicious JavaScript that executes in the browser of any victim who later views the affected page (CVSS 3.1 5.4, CWE-79, scope-changed with low confidentiality and integrity impact, no availability impact). Because delivery depends on a second party browsing the poisoned page, the vector carries UI:R and there is no unauthenticated remote or automatable mass-exploitation path; impact is confined to the victim's browser session. At the time of analysis there was no public exploit identified, no CISA KEV listing, and EPSS was low at 0.25% (15th percentile), which places this in the routine enterprise-patching queue rather than an emergency-response tier.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - including AEM Cloud Service and AEM 6.5 LTS - lets an authenticated low-privileged author persist malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page. Because exploitation requires both authoring-level write access and a separate victim who browses the poisoned page, the issue is rated CVSS 5.4 (moderate) rather than critical. There is no CISA KEV listing, no public exploit identified at time of analysis, and EPSS is low at 0.25% (15th percentile), consistent with the credential-plus-victim-interaction prerequisites.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated, low-privileged user to inject malicious JavaScript into form fields, and that script then executes in the browser of any victim who later views the page containing the vulnerable field. The attacker cannot trigger the payload on their own - it requires a victim to browse the affected page, which is why the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) carries only Low Confidentiality and Integrity impact with no Availability impact and a scope change reflecting execution in the victim's browser context. Exploitation signals are weak: EPSS is 0.25% (roughly the 15th percentile), it is not listed in CISA KEV, and no public exploit code has been identified at time of analysis - this is a moderate-severity, low-priority issue for most defenders unless AEM form content is widely exposed to privileged or administrative users.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service enables a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they browse to the page containing the field. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting the need for an authenticated authoring account and victim interaction; EPSS is 0.25% (15th percentile) and no public exploit code has been identified at time of analysis. Exploitation conditions match the independent assessment: attacker requires form-authoring/editing access (PR:L) and a separate user must view the page (UI:R).
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - spanning the on-premise/Managed Services 6.5 line, 6.5 LTS, and affected AEM Cloud Service releases - allows a low-privileged authenticated user to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who browses the page rendering that content. Because the assessed vector requires an authenticated account (PR:L) and a second user to view the injected content (UI:R), the impact is bounded to the victim's browser session with low confidentiality and integrity effects, a scope change, and no availability impact, so our independent assessment rates this a genuinely moderate-severity, low-priority issue rather than a top-tier threat. No public exploit identified at time of analysis, and EPSS is only 0.25% (15th percentile), indicating low predicted exploitation activity.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, including 6.5 LTS and AEM Cloud Service, enables a low-privilege authenticated author to inject JavaScript into form fields that executes when a victim browses to the poisoned page. Exploitation demands both a provisioned low-privilege account and victim interaction, and EPSS scores the likelihood of exploitation in the next 30 days at 0.25% (15th percentile); no public exploit identified at time of analysis and no CISA KEV entry.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged, authenticated attacker to inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who later views the affected page. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that the attacker needs a valid low-privilege account and that a separate victim must browse to the poisoned content before any code runs; there is no public exploit identified at time of analysis and EPSS is 0.25% (15th percentile), indicating low near-term exploitation likelihood. Both AEM 6.5 LTS and AEM Cloud Service fall within the affected scope per the vendor CPE data.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged attacker to execute malicious scripts in a victim's browser when the victim visits an attacker-crafted URL or interacts with a manipulated web page. Exploitation requires a valid low-privilege account (PR:L) and victim interaction (UI:R), significantly limiting realistic risk. No public exploit code has been identified, and EPSS is 0.25% (15th percentile), indicating a low likelihood of exploitation; this is a moderate-severity, low-priority issue rather than an urgent threat.
Stored cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious scripts into vulnerable form fields, which execute in a victim's browser when they browse to the affected page. Exploitation requires valid credentials with form-authoring access and victim interaction, and the impact is limited to script execution in the victim's browser. The EPSS score is low at 0.25%, and no public exploit code has been identified, making this a moderate-to-low priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, in the 6.5 LTS line, and in AEM Cloud Service lets a low-privileged authenticated account inject malicious JavaScript into form fields that is later rendered in the browser of any user who visits the affected page. An attacker therefore needs a valid low-privileged author-level account (PR:L) plus a victim who browses the poisoned page (UI:R); successful execution is scoped to the victim's browser session, with low confidentiality and integrity impact and no availability impact (CVSS 5.4). No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.25% (15th percentile), so this rates as a moderate-severity, limited-urgency item rather than an emergency patch.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated low-privileged user to inject persistent malicious scripts into form fields, which then execute in the browser of any separate victim who views the affected page. Exploitation requires valid authoring-level credentials and victim interaction, and impact is limited to the victim's browser session confidentiality and integrity. No public exploit code or active exploitation has been identified; EPSS is 0.25% (15th percentile), indicating low real-world urgency.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service allows a low-privileged authenticated attacker to inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when they visit the affected page. Exploitation requires the attacker to have a valid low-privileged account (PR:L) and the victim to interact with the page (UI:R), and no public exploit code or active exploitation has been identified at time of analysis. With a CVSS score of 5.4 and an EPSS of 0.25% (15th percentile), this is a genuine but moderate-priority issue rather than a critical emergency.
Stored cross-site scripting (XSS) in Adobe Experience Manager (AEM) 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service allows a low-privileged authenticated attacker with form-editing permissions to inject malicious scripts into form fields. The payload executes in the browser of any user who subsequently views the compromised page, but the impact is confined to the victim's session and requires user interaction. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.25% (15th percentile), making this a moderate-severity, low-priority issue.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM Cloud Service allows an authenticated, low-privileged attacker to inject malicious JavaScript into persistent form fields, which then executes in the browser of any user who views the affected page (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Exploitation is not anonymous: it requires valid low-privilege credentials with permission to write to a vulnerable form field plus a separate victim browsing to the tainted page, and it is not confirmed actively exploited (CISA KEV) with no public exploit identified at time of analysis and a low EPSS of 0.25% (15th percentile). The impact is bounded to low confidentiality and integrity within the victim's browser session, but the changed scope (S:C) means injected script can act beyond the vulnerable component.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows an authenticated, low-privileged attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim's browser when they view the affected page. The attacker must have valid AEM credentials with content-authoring rights, and a separate victim must browse to the compromised content, so this is not remotely exploitable without authentication. With a CVSS score of 5.4 and an EPSS score of 0.25% (15th percentile), the immediate risk is moderate; no public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier lets an authenticated low-privileged user inject persistent JavaScript into vulnerable form fields, which then executes in the browser of any victim who subsequently views the affected page. The flaw requires both a valid authoring-level account with form-input capability and victim interaction, and its impact is confined to the browser context, so it is assessed as a moderate-priority issue (CVSS 5.4, EPSS 0.25%). No public exploit code or confirmed active exploitation was identified at time of analysis.
DOM-based cross-site scripting (XSS) in Adobe Experience Manager 6.5.23 and earlier permits a low-privileged authenticated attacker to execute arbitrary JavaScript in a victim's browser when the victim visits a crafted URL or interacts with a manipulated page. Exploitation requires both an authenticated account (PR:L) and user interaction (UI:R), limiting the impact to limited confidentiality and integrity changes within the browser (CVSS 5.4). No public exploit code or active exploitation has been identified; EPSS is 0.25% (15th percentile), indicating a low likelihood of exploitation.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to execute arbitrary script in a victim's browser session when the victim visits a crafted URL or interacts with a manipulated page. Per the CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) the attacker must first hold an authenticated low-privileged account on the AEM instance, and successful exploitation depends on social-engineering the victim into interacting with attacker-supplied content; impact is limited to Low confidentiality and integrity with no availability effect, and the scope change reflects script running in the victim's browser origin. Risk is moderate rather than urgent: EPSS is only 0.25% (15th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; a vendor advisory addressing the issue is available (Adobe APSB25-115).
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier - covering 6.5 LTS and AEM as a Cloud Service per the affected CPE data - allows an attacker holding a valid low-privilege AEM account to execute malicious script in a victim's browser, but only after the victim is induced to visit a crafted URL or interact with a manipulated web page. The CVSS vector (PR:L/UI:R, S:C, C:L/I:L/A:N, base 5.4) confirms both the authenticated, low-privilege prerequisite and the mandatory user interaction, so the issue cannot be triggered silently or at scale and the attacker pool is narrowed to insiders or compromised accounts. No public exploit code has been identified at time of analysis, EPSS is a low 0.25% (15th percentile), and there is no CISA KEV listing, which together support a moderate, not top-priority rating rather than an emergency response.
DOM-based cross-site scripting in Adobe Experience Manager 6.5.23 and earlier, AEM 6.5 LTS, and AEM as a Cloud Service allows a low-privileged authenticated attacker to execute malicious script in a victim’s browser when the victim visits a crafted URL or interacts with a manipulated page. Both a valid low-privileged account and victim interaction are required, and impact is limited to client-side script execution within the AEM origin with no availability impact or server-side code execution. EPSS is low (0.25%) and no public exploit identified at time of analysis.
Stored cross-site scripting in Adobe Experience Manager 6.5.23 and earlier allows a low-privileged authenticated attacker to inject malicious JavaScript into vulnerable form fields, which then executes in a victim’s browser when the victim views the affected page. Exploitation requires victim interaction and an authenticated account with form-field write access, and the impact is limited to the victim’s browser session (CVSS 5.4, CWE-79); EPSS is 0.25% (15th percentile) and no public exploit has been identified at time of analysis. The most realistic exposure is in authoring or multi-tenant deployments where lower-trust content contributors can persist content that is later viewed by higher-privileged users.