Stored script execution via vulnerable form fields

Stored XSS in Adobe Experience Manager 6.5.19 and earlier allows remote authenticated users to execute scripts in a victim's browser via form fields. A vulnerable form field stores attacker-supplied JavaScript and later renders it without effective neutralization when another user opens the containing page; Adobe has not identified the exact field or handler. Exploitation requires low-privileged access to submit content and user interaction by a victim, and its demonstrated consequence is script execution in that victim's browser.