CVE-2025-30292

Medium · 6.1

CVSS

6.1

EPSS

15.5%

Published

Apr 8, 2025

CISA due date

—

The record

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Affected packages

Ecosystem	Package	Introduced	Fixed