Lucee

5 CVEs across 3 Lucee products. Browse Lucee vulnerabilities, severities, and proof-of-concept exploits.

Lucee products with known CVEs

ProductCVEs
Lucee4
Lucee Server1
Lucee Server1
Lucee CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-29519High8.22026-07-10Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing t…
CVE-2023-538802025-12-15Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative i…
CVE-2024-55354High8.82025-04-08Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a protection mechanism failure that can let a…
CVE-2023-38693Critical9.82025-03-05Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vuln…
CVE-2021-21307High8.62021-02-11Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47…