CVE-2026-75993

HighCVSS 8.5/10Last modified Sep 18, 2026

Description

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 8, 2026
Last modified
Sep 18, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-759949.6ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-759958.4ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the curCVE-2026-759967.5ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker cCVE-2026-759987.5ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit CVE-2026-759998.4ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the curCVE-2026-76006.3A flaw has been found in ArtMin96 yii2-mcp-server 1.0.2. This impacts the function yii_command_help/yii_execute_command of the file src/indeCVE-2026-760006.5ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker cCVE-2026-760017.1ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attCVE-2026-760026.1ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL rCVE-2026-760039.9A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. CVE-2026-760049.9A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strCVE-2026-760064.9The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all
CVE-2026-75993: High severity, CVSS 8.5 | Vulnix