CVE-2025-30292CWE-79

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)

Medium · published April 8, 2025

CVSS v3.1

6.1

EPSS

16%

Percentile

96.8

In the wild

Unconfirmed

What it is

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.15506 · 96.8th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-04-08T20:03Z

EPSS history

Timeline

08 APR 20:03Z
ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
cvelistv5