CVE-2026-48307
EUVD-2026-4034230.06.2026, 16:16
ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious link. Scope is changed.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| adobe | coldfusion | 2023.0 |
| adobe | coldfusion | 2023.1 |
| adobe | coldfusion | 2023.10 |
| adobe | coldfusion | 2023.11 |
| adobe | coldfusion | 2023.12 |
| adobe | coldfusion | 2023.13 |
| adobe | coldfusion | 2023.14 |
| adobe | coldfusion | 2023.15 |
| adobe | coldfusion | 2023.16 |
| adobe | coldfusion | 2023.17 |
| adobe | coldfusion | 2023.18 |
| adobe | coldfusion | 2023.19 |
| adobe | coldfusion | 2023.2 |
| adobe | coldfusion | 2023.20 |
| adobe | coldfusion | 2023.3 |
| adobe | coldfusion | 2023.4 |
| adobe | coldfusion | 2023.5 |
| adobe | coldfusion | 2023.6 |
| adobe | coldfusion | 2023.7 |
| adobe | coldfusion | 2023.8 |
| adobe | coldfusion | 2023.9 |
| adobe | coldfusion | 2025.0 |
| adobe | coldfusion | 2025.1 |
| adobe | coldfusion | 2025.2 |
| adobe | coldfusion | 2025.3 |
| adobe | coldfusion | 2025.4 |
| adobe | coldfusion | 2025.5 |
| adobe | coldfusion | 2025.6 |
| adobe | coldfusion | 2025.7 |
| adobe | coldfusion | 2025.8 |
| adobe | coldfusion | 2025.9 |
𝑥
= Vulnerable software versions