ColdFusion versions 2023.19, 2025.8 and earlier contain a stored Cross‑Site Scripting vulnerability that allows a low‑privileged attacker to inject malicious JavaScript into form fields. Once a victim accesses the compromised page, the injected script executes in the victim’s browser, potentially defacing content, stealing session data or injecting further malware. The weakness is a classic input validation flaw (CWE‑79).

Adobe ColdFusion running version 2023.19, 2025.8 or earlier is affected. The flaw is present in all installations of these versions that expose form input to the internet, regardless of operating platform.

The CVSS score of 4.8 indicates a low‑to‑moderate severity, and the EPSS score is unavailable but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through legitimate form input; an attacker only needs to embed JavaScript into a form field such as a user profile or comment box and then persuade or trick an end user to visit the resulting page. Because the scope is changed, compromised credentials could affect all users with access to the affected system.