CVE-2023-53880

Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters. Attackers can craft specific payloads targeting admin pages like server.cfm and web.cfm to execute arbitrary JavaScript in victim's browser sessions.

CVSS v4.0

4.8 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

0.33% chance of exploitation in the next 30 days, 26th percentile

Published

2025-12-15

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/51668

References

• CVE Record
• NVD entry

Related

• CVE-2023-53879
• CVE-2023-53881
• CVE-2023-53878
• CVE-2023-53882
• CVE-2023-53877
• CVE-2023-53883