CVEvulnerability

CVE-2026-48320

8.5 HIGH Published 2026-07-14 Modified 2026-08-28 Official page ↗
Status
Analyzed
Published
2026-07-14
Last modified
2026-08-28
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.5 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1 ([email protected])
8.5 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-79

Description

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Affected configurations

• adobe coldfusion 2023 • adobe coldfusion 2025

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References