CVE-2023-53880: Lucee

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters. Attackers can craft specific payloads targeting admin pages like server.cfm and web.cfm to execute arbitrary JavaScript in victim's browser sessions.

Affected products

• Lucee Lucee: version 5.4.2.17 only

Published 2025-12-15. Last modified 2026-06-17.