CVE-2026-47933

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2023.19 and earlier ColdFusion versions 2025.8 and earlier

Description A stored Cross-Site Scripting (XSS) issue allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. This can result in the execution of malicious JavaScript in a victim's browser when they visit the page containing the affected field. This occurs with a change in scope.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.