CVE-2026-21269
EUVD-2026-5654411.08.2026, 17:17
ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | 2023.0 |
| adobe | coldfusion | 2023.1 |
| adobe | coldfusion | 2023.10 |
| adobe | coldfusion | 2023.11 |
| adobe | coldfusion | 2023.12 |
| adobe | coldfusion | 2023.13 |
| adobe | coldfusion | 2023.14 |
| adobe | coldfusion | 2023.15 |
| adobe | coldfusion | 2023.16 |
| adobe | coldfusion | 2023.17 |
| adobe | coldfusion | 2023.18 |
| adobe | coldfusion | 2023.19 |
| adobe | coldfusion | 2023.2 |
| adobe | coldfusion | 2023.20 |
| adobe | coldfusion | 2023.21 |
| adobe | coldfusion | 2023.22 |
| adobe | coldfusion | 2023.3 |
| adobe | coldfusion | 2023.4 |
| adobe | coldfusion | 2023.5 |
| adobe | coldfusion | 2023.6 |
| adobe | coldfusion | 2023.7 |
| adobe | coldfusion | 2023.8 |
| adobe | coldfusion | 2023.9 |
| adobe | coldfusion | 2025.0 |
| adobe | coldfusion | 2025.1 |
| adobe | coldfusion | 2025.10 |
| adobe | coldfusion | 2025.11 |
| adobe | coldfusion | 2025.2 |
| adobe | coldfusion | 2025.3 |
| adobe | coldfusion | 2025.4 |
| adobe | coldfusion | 2025.5 |
| adobe | coldfusion | 2025.6 |
| adobe | coldfusion | 2025.7 |
| adobe | coldfusion | 2025.8 |
| adobe | coldfusion | 2025.9 |
𝑥
= Vulnerable software versions