GCVE-110-NCSC-2026-362

Advisory PublishedCVSS 8.6/10

Vulnetix · Advisory published September 9, 2026

A stored Cross-Site Scripting (XSS) vulnerability in ColdFusion allows low-privileged attackers to inject malicious scripts into form fields that execute in victims' browsers upon visiting the affected page, with the scope of the issue changed.

Download JSON Open in Console

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Risk Scores

CVSS 3.1

8.6/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions	Platforms
Adobe	vers:unknown/*	—	—

Aliases

CVE-2026-21269 CVE-2026-48273 CVE-2026-75746 CVE-2026-75993 CVE-2026-75998 CVE-2026-75999 CVE-2026-76000 CVE-2026-76002 CVE-2026-76190

References

advisory

Browse GCVE Records

495 records in the GCVE database · Updated September 10, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON