CVE-2020-15929: Ortussolutions Testbox

Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days.

In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters passed to system/runners/HTMLRunner.cfm allow an attacker to write an arbitrary CFM file (within the application's context) containing attacker-defined CFML tags, leading to Remote Code Execution.

Affected products

• Ortussolutions Testbox: from 2.4.0, up to and including 4.1.0

Published 2020-11-24. Last modified 2026-06-17.