cbcvebase.
CVE-2025-30292
published 2025-04-08

CVE-2025-30292: ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to…

PriorityP433medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
12.03%
95.6th percentile
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Affected

4 ranges
VendorProductVersion rangeFixed in
adobecoldfusion<= 2025.0—
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.