CVE-2026-47933
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields.
Risk Assessment
An attacker could inject malicious JavaScript that may be executed in a victim's browser, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to update ColdFusion to the latest version to mitigate this vulnerability and to review and secure forms against script injection.
Original NVD description (English source)
ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.