CVE-2026-29519-Lucee-Reflected-XSS

CVE-2026-29519-Lucee-Reflected-XSS Proof of Concept for Reflected XSS in Lucee CFML CVE-2026-29519 Framework 0-Day: Reflected XSS in Lucee CFML URL Parsing Affects Enterprise Deployments Versions 5.3.1.95 to 7.x Discoverer: Fouad Milat lavado Date Discovered: December 6, 2025 CVE: CVE-2026-29519...

CVE-2026-111450

Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts an attacker-chosen Host, an attacker whose request...

Lucee - imgProcess.cfm Unauthenticated RCE (CVE-2021-21307)

Exploits CVE-2021-21307 by writing a CFML shell via /lucee/admin/imgProcess.cfm?file=.cfm and executing commands through cfexecute. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Lucee imgProcess.cfm unauthenticated RCE CVE-2021-21307 — opens execute session.""...

Lucee - imgProcess.cfm Unauth Access Detection (CVE-2021-21307)

Detects CVE-2021-21307 by writing a unique CFML marker via /lucee/admin/imgProcess.cfm?file=.cfm and confirming it on GET. !/usr/bin/env python3 -- coding: utf-8 -- """Lucee admin imgProcess.cfm unauthenticated access CVE-2021-21307.""" from kittysploit import from lib.protocols.http.httpclient...

Lucee Default Page Detection

Detects Lucee Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Lucee Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Lucee Default Page Detection', 'description': 'Detects Lucee Defaul...

Lucee Web and Lucee Server Admin Login Panel - Detect

Lucee admin login panels were detected in both Web and Server tabs. !/usr/bin/env python3 -- coding: utf-8 -- """Lucee admin login panels were detected in both Web and Server tabs.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

Lucee Stack Trace Error Detection

Lucee Stack Trace error exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Lucee Stack Trace error exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Lucee Stack Trace Error Detection', 'description': 'Lucee...

Lucee - Unset Credentials Detection

The Lucee admin panel has a first-time setup page which allows any user to set the administrator password. !/usr/bin/env python3 -- coding: utf-8 -- """The Lucee admin panel has a first-time setup page which allows any user to set the administrator password.""" from kittysploit import from...

CVE-2026-29519

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

CVE-2026-29519

CVE-2026-29519 affects Lucee CFML Server across 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines. It describes a reflected cross-site scripting vulnerability in URL path parsing, where unauthenticated remote attackers can cause arbitrary JavaScript to execute in a victim’s browser by embedding payloa...

CVE-2026-29519

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

CVE-2026-29519 Lucee CFML Server Reflected XSS via URL Path Parsing

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

EUVD-2026-42906

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

CVE-2026-29519 Lucee CFML Server Reflected XSS via URL Path Parsing

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

CVE-2026-29519 Lucee CFML Server Reflected XSS via URL Path Parsing

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

PT-2026-57164

Name of the Vulnerable Software and Affected Versions Lucee CFML Server versions 5.3.x Lucee CFML Server versions 6.1.x Lucee CFML Server versions 6.2.x Lucee CFML Server versions 7.0.x Description Reflected cross-site scripting occurs during URL path parsing, allowing unauthenticated remote...

CVE-2026-29519: Improper Neutralization of Input During Web Page Generation

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads...

Exploit for CVE-2026-29519

CVE-2026-29519-Lucee-Reflected-XSS Proof of Concept for Reflec...

Java Lucee Administrative Interface Code Execution

The vulnerability of the administrative interface of the Java Lucee virtual machine’s scripting language is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2023-53880

Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters. Attackers can craft specific payloads targeting admin pages like server.cfm and web.cfm to execute arbitrary JavaScri...