CVE-2023-53880 — Lucee 5.4.2.17 Authenticated Reflected Cross-Site Scripting via Admin Interfaces
Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameter…
Published: 2025-12-15 · CVSS: 4.8 · CVSS 4.0
Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters. Attackers can craft specific payloads targeting admin pages like server.cfm and web.cfm to execute arbitrary JavaScript in victim's browser sessions.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7