# Adobe ColdFusion. Every CVE that names Adobe ColdFusion among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)](https://agentprime.io/advisories/CVE-2025-61808.md) `CVE-2025-61808` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 9 Dec 2025 · Tags: Unrestricted file upload - [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-61813.md) `CVE-2025-61813` · CVE record: Adobe ColdFusion · CVSS 7.4 High · Not analysed yet · Published 9 Dec 2025 · Tags: XML external entities (XXE) - [ColdFusion | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2025-61812.md) `CVE-2025-61812` · CVE record: Adobe ColdFusion · CVSS 8.4 High · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-20 - [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-61821.md) `CVE-2025-61821` · CVE record: Adobe ColdFusion · CVSS 6.8 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: XML external entities (XXE) - [ColdFusion | Insufficiently Protected Credentials (CWE-522)](https://agentprime.io/advisories/CVE-2025-64898.md) `CVE-2025-64898` · CVE record: Adobe ColdFusion · CVSS 5.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Hard-coded credentials - [ColdFusion | Deserialization of Untrusted Data (CWE-502)](https://agentprime.io/advisories/CVE-2025-61810.md) `CVE-2025-61810` · CVE record: Adobe ColdFusion · CVSS 8.4 High · Not analysed yet · Published 9 Dec 2025 · Tags: Insecure deserialization - [ColdFusion | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2025-61809.md) `CVE-2025-61809` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-20 - [ColdFusion | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2025-61822.md) `CVE-2025-61822` · CVE record: Adobe ColdFusion · CVSS 6.2 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-20 - [ColdFusion | Improper Access Control (CWE-284)](https://agentprime.io/advisories/CVE-2025-64897.md) `CVE-2025-64897` · CVE record: Adobe ColdFusion · CVSS 5.6 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Broken access control - [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-61823.md) `CVE-2025-61823` · CVE record: Adobe ColdFusion · CVSS 6.2 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: XML external entities (XXE) - [ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2025-61811.md) `CVE-2025-61811` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: Path traversal - [ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2025-54261.md) `CVE-2025-54261` · CVE record: Adobe ColdFusion · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 9 Sept 2025 · Tags: Path traversal - [ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2025-54234.md) `CVE-2025-54234` · CVE record: Adobe ColdFusion · CVSS 2.7 Low · Not analysed yet · Published 18 Aug 2025 · Tags: Server-side request forgery (SSRF) - [ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2025-49542.md) `CVE-2025-49542` · CVE record: Adobe ColdFusion · CVSS 5.2 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: Cross-site scripting (XSS) - [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-49535.md) `CVE-2025-49535` · CVE record: Adobe ColdFusion · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2025 · Tags: XML external entities (XXE) - [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2025-49536.md) `CVE-2025-49536` · CVE record: Adobe ColdFusion · CVSS 7.3 High · Not analysed yet · Published 8 Jul 2025 · Tags: Broken access control - [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-49539.md) `CVE-2025-49539` · CVE record: Adobe ColdFusion · CVSS 4.5 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: XML external entities (XXE) - [ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2025-49545.md) `CVE-2025-49545` · CVE record: Adobe ColdFusion · CVSS 6.2 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: Server-side request forgery (SSRF) - [ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2025-49541.md) `CVE-2025-49541` · CVE record: Adobe ColdFusion · CVSS 4.3 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: Cross-site scripting (XSS) - [ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2025-49537.md) `CVE-2025-49537` · CVE record: Adobe ColdFusion · CVSS 7.9 High · Not analysed yet · Published 8 Jul 2025 · Tags: Command injection - [ColdFusion | Use of Hard-coded Credentials (CWE-798)](https://agentprime.io/advisories/CVE-2025-49551.md) `CVE-2025-49551` · CVE record: Adobe ColdFusion · CVSS 8.8 High · Not analysed yet · Published 8 Jul 2025 · Tags: Hard-coded credentials - [ColdFusion | Improper Access Control (CWE-284)](https://agentprime.io/advisories/CVE-2025-49546.md) `CVE-2025-49546` · CVE record: Adobe ColdFusion · CVSS 2.4 Low · Not analysed yet · Published 8 Jul 2025 · Tags: Broken access control - [ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)](https://agentprime.io/advisories/CVE-2025-49544.md) `CVE-2025-49544` · CVE record: Adobe ColdFusion · CVSS 6.8 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: XML external entities (XXE) - [ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2025-49543.md) `CVE-2025-49543` · CVE record: Adobe ColdFusion · CVSS 4.3 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: Cross-site scripting (XSS) - [ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2025-49540.md) `CVE-2025-49540` · CVE record: Adobe ColdFusion · CVSS 4.3 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: Cross-site scripting (XSS) - [ColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91)](https://agentprime.io/advisories/CVE-2025-49538.md) `CVE-2025-49538` · CVE record: Adobe ColdFusion · CVSS 7.4 High · Not analysed yet · Published 8 Jul 2025 · Tags: Other injection - [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2025-43565.md) `CVE-2025-43565` · CVE record: Adobe ColdFusion · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.18 · Not analysed yet · Published 13 May 2025 · Tags: Broken access control - [ColdFusion | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2025-43559.md) `CVE-2025-43559` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2025 · Tags: CWE-20 - [ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2025-43562.md) `CVE-2025-43562` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.51 · Not analysed yet · Published 13 May 2025 · Tags: Command injection - [ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2025-43566.md) `CVE-2025-43566` · CVE record: Adobe ColdFusion · CVSS 6.8 Medium · EPSS 0.58 · Not analysed yet · Published 13 May 2025 · Tags: Path traversal - [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2025-43564.md) `CVE-2025-43564` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 13 May 2025 · Tags: Broken access control - [ColdFusion | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2025-43560.md) `CVE-2025-43560` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.23 · Not analysed yet · Published 13 May 2025 · Tags: CWE-20 - [ColdFusion | Improper Access Control (CWE-284)](https://agentprime.io/advisories/CVE-2025-43563.md) `CVE-2025-43563` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 13 May 2025 · Tags: Broken access control - [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2025-43561.md) `CVE-2025-43561` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.24 · Not analysed yet · Published 13 May 2025 · Tags: Broken access control - [ColdFusion | Improper Authentication (CWE-287)](https://agentprime.io/advisories/CVE-2025-30287.md) `CVE-2025-30287` · CVE record: Adobe ColdFusion · CVSS 8.2 High · Not analysed yet · Published 8 Apr 2025 · Tags: Authentication bypass - [ColdFusion | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2025-30293.md) `CVE-2025-30293` · CVE record: Adobe ColdFusion · CVSS 6.8 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-20 - [ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2025-30292.md) `CVE-2025-30292` · CVE record: Adobe ColdFusion · CVSS 6.1 Medium · EPSS 0.16 · Not analysed yet · Published 8 Apr 2025 · Tags: Cross-site scripting (XSS) - [ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2025-30290.md) `CVE-2025-30290` · CVE record: Adobe ColdFusion · CVSS 8.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 8 Apr 2025 · Tags: Path traversal - [ColdFusion | Improper Authentication (CWE-287)](https://agentprime.io/advisories/CVE-2025-30282.md) `CVE-2025-30282` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2025 · Tags: Authentication bypass - [ColdFusion | Deserialization of Untrusted Data (CWE-502)](https://agentprime.io/advisories/CVE-2025-30284.md) `CVE-2025-30284` · CVE record: Adobe ColdFusion · CVSS 8.4 High · Not analysed yet · Published 8 Apr 2025 · Tags: Insecure deserialization - [ColdFusion | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2025-30294.md) `CVE-2025-30294` · CVE record: Adobe ColdFusion · CVSS 6.8 Medium · EPSS 0.17 · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-20 - [ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2025-30289.md) `CVE-2025-30289` · CVE record: Adobe ColdFusion · CVSS 8.2 High · Not analysed yet · Published 8 Apr 2025 · Tags: Command injection - [ColdFusion | Improper Access Control (CWE-284)](https://agentprime.io/advisories/CVE-2025-30288.md) `CVE-2025-30288` · CVE record: Adobe ColdFusion · CVSS 8.2 High · Not analysed yet · Published 8 Apr 2025 · Tags: Broken access control - [ColdFusion | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2025-24446.md) `CVE-2025-24446` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-20 - [ColdFusion | Deserialization of Untrusted Data (CWE-502)](https://agentprime.io/advisories/CVE-2025-24447.md) `CVE-2025-24447` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2025 · Tags: Insecure deserialization - [ColdFusion | Improper Access Control (CWE-284)](https://agentprime.io/advisories/CVE-2025-30281.md) `CVE-2025-30281` · CVE record: Adobe ColdFusion · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.24 · Not analysed yet · Published 8 Apr 2025 · Tags: Broken access control - [ColdFusion | Information Exposure (CWE-200)](https://agentprime.io/advisories/CVE-2025-30291.md) `CVE-2025-30291` · CVE record: Adobe ColdFusion · CVSS 5.5 Medium · Not analysed yet · Published 8 Apr 2025 · Tags: Information disclosure - [ColdFusion | Deserialization of Untrusted Data (CWE-502)](https://agentprime.io/advisories/CVE-2025-30285.md) `CVE-2025-30285` · CVE record: Adobe ColdFusion · CVSS 8.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.31 · Not analysed yet · Published 8 Apr 2025 · Tags: Insecure deserialization - [ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2025-30286.md) `CVE-2025-30286` · CVE record: Adobe ColdFusion · CVSS 8.4 High · Not analysed yet · Published 8 Apr 2025 · Tags: Command injection - [ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2024-53961.md) `CVE-2024-53961` · CVE record: Adobe ColdFusion · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 23 Dec 2024 · Tags: Path traversal - [ColdFusion | Deserialization of Untrusted Data (CWE-502)](https://agentprime.io/advisories/CVE-2024-41874.md) `CVE-2024-41874` · CVE record: Adobe ColdFusion · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.30 · Not analysed yet · Published 13 Sept 2024 · Tags: Insecure deserialization - [ColdFusion | Improper Authentication (CWE-287)](https://agentprime.io/advisories/CVE-2024-45113.md) `CVE-2024-45113` · CVE record: Adobe ColdFusion · CVSS 7.5 High · Not analysed yet · Published 13 Sept 2024 · Tags: Authentication bypass - [ColdFusion CFDOCUMENT file retrieval / access control bypass](https://agentprime.io/advisories/CVE-2024-34112.md) `CVE-2024-34112` · CVE record: Adobe ColdFusion · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.24 · Not analysed yet · Published 13 Jun 2024 · Tags: Broken access control - [ColdFusion | Weak Cryptography for Passwords (CWE-261)](https://agentprime.io/advisories/CVE-2024-34113.md) `CVE-2024-34113` · CVE record: Adobe ColdFusion · CVSS 5.5 Medium · Not analysed yet · Published 13 Jun 2024 · Tags: CWE-261 - [ColdFusion | Improper Access Control (CWE-284)](https://agentprime.io/advisories/CVE-2024-20767.md) `CVE-2024-20767` · CVE record: Adobe ColdFusion · CVSS 7.4 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 18 Mar 2024 · Tags: Broken access control - [Adobe ColdFusion RCE Security Vulnerability](https://agentprime.io/advisories/CVE-2023-44351.md) `CVE-2023-44351` · CVE record: Adobe ColdFusion · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.50 · Not analysed yet · Published 17 Nov 2023 · Tags: Insecure deserialization - [ColdFusion | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2023-44355.md) `CVE-2023-44355` · CVE record: Adobe ColdFusion · CVSS 4.3 Medium · EPSS 0.47 · Not analysed yet · Published 17 Nov 2023 · Tags: CWE-20 - [CVE-2023-38205 issues | ColdFusion Admin Panel Access](https://agentprime.io/advisories/CVE-2023-26347.md) `CVE-2023-26347` · CVE record: Adobe ColdFusion · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 17 Nov 2023 · Tags: Broken access control - [Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version](https://agentprime.io/advisories/CVE-2023-44352.md) `CVE-2023-44352` · CVE record: Adobe ColdFusion · CVSS 6.1 Medium · EPSS 0.85 · Not analysed yet · Published 17 Nov 2023 · Tags: Cross-site scripting (XSS) - [ColdFusion WDDX Deserialization Gadgets](https://agentprime.io/advisories/CVE-2023-44353.md) `CVE-2023-44353` · CVE record: Adobe ColdFusion · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.80 · Not analysed yet · Published 17 Nov 2023 · Tags: Insecure deserialization Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .