Adobe ColdFusion Reflected Cross-Site Scripting Vulnerability

A reflected Cross-Site Scripting vulnerability has been identified in Adobe ColdFusion versions 2023.12, 2021.18, and 2025.0 and earlier. This vulnerability allows an attacker to execute malicious JavaScript in the context of the victim's browser by convincing them to visit a URL that references a vulnerable page.

Impact

Exploitation of this vulnerability allows for reflected Cross-Site Scripting, where an attacker can execute malicious scripts in the context of the user's browser session.