CVE-2025-30292

MEDIUM 6.1CVE-2025-30292 · Published 08/04/2025 · updated 17/06/2026

In short

CVE-2025-30292 is a MEDIUM (CVSS 6.1) vulnerability affecting coldfusion (adobe).
Chance of exploitation in the next 30 days (EPSS): 15.5%, higher than 96.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
coldfusion adobe	`= 2021= 2023= 2025`	No fix yet

Description

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

References

helpx.adobe.com/security/products/coldfusion/apsb25-15.html · Vendor Advisory

More vulnerabilities in coldfusion

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

coldfusion

adobe

= 2021= 2023= 2025

No fix yet

Description

More vulnerabilities in coldfusion

See all →