TI-2021-04407 CVE-2021-21307
Remote Code Exploit in Lucee Admin
Priority CRITICAL 85
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development.
lucee
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
lucee records in CISA KEVNo lucee vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2026-23334 CVE-2026-29519 · GHSA-frv8-q5jq-3qhq
Lucee CFML Server Reflected XSS via URL Path Parsing
Priority MEDIUM 61
Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitr…
TI-2023-20042 CVE-2023-38693 · GHSA-vwjx-mmwm-pwrf
RCE in Lucee REST endpoint
Priority MEDIUM 44
Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development.
TI-2024-36819 CVE-2024-55354
Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the…
Priority LOW 39
Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expected to be blocked and…
TI-2023-30163 CVE-2023-53880 · GHSA-fj37-48wv-9r2p
Lucee 5.4.2.17 Authenticated Reflected Cross-Site Scripting via Admin Interfaces
Priority LOW 22
Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters.