Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 12 9.0.1 before Update 11 9.0.2 before Update 6 and 10 before Update 12 when the CFIDE directory is available allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the logviewer directory.