CVE-2023-44352

MEDIUM EXPLOITED NUCLEI

Adobe Coldfusion < 2021 - XSS

Title source: rule

Description

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

Nuclei Templates (1)

Adobe Coldfusion - Cross-Site Scripting

MEDIUMVERIFIEDby pwnwithlove

Shodan:

http.component:"Adobe Coldfusion" || http.component:"adobe coldfusion" || http.title:"coldfusion administrator login" || cpe:"cpe:2.3:a:adobe:coldfusion"

FOFA: title="coldfusion administrator login" || app="adobe-coldfusion"

References (1)

[Release Notes, Vendor Advisory] https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html

Scores

CVSS v3 6.1

EPSS 0.8013

EPSS Percentile 99.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

VulnCheck KEV 2025-12-26

CWE

CWE-79

Status published

Products (3)

adobe/coldfusion 2021 (12 CPE variants)

adobe/coldfusion 2023 (6 CPE variants)

adobe/coldfusion < 2021

Published Nov 17, 2023

Tracked Since Feb 18, 2026