Vulnerabilities

TI-2026-23334 CVE-2026-29519 · GHSA-frv8-q5jq-3qhq

Lucee CFML Server Reflected XSS via URL Path Parsing

MEDIUM 61

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitr…

CVSS 4.0MEDIUM 6.2 Network No auth User interaction EPSS 0.00472 Published 2026-07-10 No fix listed CWE-79

TI-2023-30163 CVE-2023-53880 · GHSA-fj37-48wv-9r2p

Lucee 5.4.2.17 Authenticated Reflected Cross-Site Scripting via Admin Interfaces

LOW 22

Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00338 Published 2025-12-15 No fix listed CWE-79

TI-2024-36819 CVE-2024-55354

Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the…

LOW 39

Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let an attacker run code that would be expected to be blocked and…

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00169 Published 2025-04-08 Fixed in 5.4.7.3 LTS, 6.1.1.118 CWE-807

TI-2023-20042 CVE-2023-38693 · GHSA-vwjx-mmwm-pwrf

RCE in Lucee REST endpoint

MEDIUM 44

Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00823 Published 2025-03-05 Fixed in 5.4.3.2, 5.3.12.1 +3 CWE-611

TI-2021-04407 CVE-2021-21307

Remote Code Exploit in Lucee Admin

CRITICAL 85

Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.89189 Published 2021-02-11 Fixed in 5.3.5.96, 5.3.6.68 +1 CWE-862