A reflected cross‑site scripting vulnerability exists in Adobe ColdFusion 2023 and 2025. Malicious scripts can be injected into a web page that is displayed to a user, allowing an attacker to hijack the victim’s session or gain elevated control. The flaw uses normal input reflected back to the browser and requires that the victim interact with a specially crafted file or link. Scope is changed.

Adobe ColdFusion 2023 and Adobe ColdFusion 2025 are affected. Patched or newer releases are not listed, so any installation of the mentioned versions is vulnerable.

The CVSS score of 8.5 indicates high severity while the EPSS score of 13% indicates a higher likelihood of exploitation. It is not listed in the CISA KEV catalog, so no known public exploitation campaigns have been reported. The vulnerability requires user interaction – the victim must open a malicious file – which limits the attack vector to social engineering or phishing, and it also changes scope, potentially affecting higher‑privileged resources. Once activated, the attacker may execute arbitrary script in the victim’s browser context, potentially elevating privileges within the application.