Browser script execution via stored form input

Stored XSS in Adobe Experience Manager allows remote authenticated users to execute script in a victim's browser via form fields. Vulnerable form fields retain attacker-supplied script content and render it when another user opens the containing page; Adobe has not identified the affected fields or published lower-level implementation details. Exploitation requires low-privileged access and victim interaction, and the resulting script runs in the victim's browser context.