Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arb…

published 2002-12-31 23 y ago modified 2026-06-16 4 mo ago also EUVD-2002-1680

cvss: 4.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 24.3%; EPSS 24.3% chance of exploitation in 30 days, percentile 97%
public exploits: 1; Exploit-DB

Cross-site scripting vulnerability (XSS) in the missing template handler in Macromedia ColdFusion MX allows remote attackers to execute arbitrary script as other users by injecting script into the HTTP request for the name of a template, which is not filtered in the resulting 404 error message.

Timeline

2002-06-13 First public exploit (EDB-21548)
2002-12-31 Published

Exploit prediction

24.27% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-21548 ColdFusion MX - Missing Template Cross-Site Scripting remote, 2002-06-13

CVSS scores

assigned by	version	score	vector
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

macromedia.com /v1/Handlers/index.cfm?ID=23047
securityfocus.com /bid/5011
vdb-entry
online.securityfocus.com /archive/1/277487
mailing-list
exchange.xforce.ibmcloud.com /vulnerabilities/9360
vdb-entry

Sources

CVE List CVE-2002-1700
NVD CVE-2002-1700

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary