CVE-2026-47933 MEDIUM

CVE-2026-47933: ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

Vendor Adobe
Product ColdFusion
Weakness CWE-79 · XSS
Published June 9, 2026
Last update June 10, 2026
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Key dates

02Disclosure timeline

June 9, 2026 CVE published
June 10, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-36841 YITH Maintenance Mode (WordPress plugin) <= 1.3.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability. CVE-2025-2269 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.34 Reflected Cross-Site Scripting via 'image_id' Parameter CVE-2024-56377 CVE-2022-4560 Joget wflow-core UniversalTheme.java getInternalJsCssLib cross site scripting CVE-2024-1919 SourceCodester Online Job Portal Manage Walkin Page ManageWalkin.php cross site scripting