cbcvebase.
CVE-2025-49542
published 2025-07-08

CVE-2025-49542: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker…

PriorityP422medium5.2CVSS 3.1
AVAACLPRNUIRSCCLILAN
EPSS
1.08%
61.8th percentile
ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser, scope is changed. The vulnerable component is restricted to internal IP addresses.

Affected

4 ranges
VendorProductVersion rangeFixed in
adobecoldfusion<= 2021.20—
adobecoldfusion——
adobecoldfusion——
adobecoldfusion——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.