CVE-2023-53880 MEDIUM

CVE-2023-53880: Lucee 5.4.2.17 Authenticated Reflected Cross-Site Scripting via Admin Interfaces

Vendor Lucee
Product Lucee
Weakness CWE-79 · XSS
Published December 15, 2025
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters. Attackers can craft specific payloads targeting admin pages like server.cfm and web.cfm to execute arbitrary JavaScript in victim's browser sessions.

Key dates

02Disclosure timeline

December 15, 2025 CVE published
April 7, 2026 Record updated