Skip to content
OpenAdvisories

Vendor

lucee

5 known vulnerabilities.

lucee at a glance

Last 12 months
2
Critical · all time
1
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202610
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202510
Mar 202511
Feb 202500
Jan 202500
Dec 202400

Products

Lucee 4 Lucee Server 1
All Critical High Medium Low Exploited only Public exploit

5 results · Feed

  • High 8.2
    CVE-2026-29519 Public exploit

    Lucee CFML Server Reflected XSS via URL Path Parsing

    Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by…

    lucee Lucee
  • Medium 4.8
    CVE-2023-53880

    Lucee 5.4.2.17 Authenticated Reflected Cross-Site Scripting via Admin Interfaces

    Lucee 5.4.2.17 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through administrative interface parameters. Attackers can craft specific payloads targeting admin pages like server.cfm and…

    lucee Lucee
  • High 8.8
    CVE-2024-55354

    Lucee before 5.4.7.3 LTS and 6 before 6.1.1.118, when an attacker can place files on the server, is vulnerable to a pro…

    lucee Lucee Server
  • Critical 9.8
    CVE-2023-38693

    RCE in Lucee REST endpoint

    Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application development. The Lucee REST endpoint is vulnerable to RCE via an XML XXE attack. This vulnerability is fixed in Lucee 5.4.3.2, 5.3.12.1, 5.3.7.5…

    lucee Lucee org.lucee:lucee Maven
  • High 8.6
    CVE-2021-21307 Public exploit EPSS 89%

    Remote Code Exploit in Lucee Admin

    Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.…

    lucee Lucee