CVE-2026-107305: Cross-site Scripting (Stored XSS) (CWE-79) in Adobe Adobe Experience Manager 6.5

CVE-2026-107305 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Experience Manager 6.5. It allows an attacker with low privileges to inject malicious JavaScript into form fields that are not properly sanitized. When other users browse pages containing these fields, the injected scripts execute in their browsers, potentially leading to information disclosure or session hijacking. The vulnerability affects versions from initial releases up to 6.5.25 inclusive. The CVSS 3.1 base score is 5.4, indicating medium severity with network attack vector, low attack complexity, low privileges required, and user interaction needed. The scope is changed, meaning the vulnerability affects resources beyond the attacker’s privileges.

An attacker with low privileges can inject malicious scripts into vulnerable form fields, which execute in the browsers of users who view the affected pages. This can lead to partial confidentiality and integrity impacts, such as theft of session tokens or manipulation of displayed content. There is no direct availability impact. The vulnerability affects the confidentiality and integrity of user data in the affected application.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a fix is applied, users should exercise caution with untrusted input in form fields and consider applying temporary mitigations such as input validation or output encoding if feasible.