Advisories · Technology

Adobe ColdFusion.

Every CVE that names Adobe ColdFusion among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-61808 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)
- Adobe ColdFusion
- Unrestricted file upload
Not analysed yet 9 Dec 2025
CVE-2025-61813 CVE record

CVSS 7.4 High

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
Not analysed yet 9 Dec 2025
CVE-2025-61812 CVE record

CVSS 8.4 High

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion
- CWE-20
Not analysed yet 9 Dec 2025
CVE-2025-61821 CVE record

CVSS 6.8 Medium

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
Not analysed yet 9 Dec 2025
CVE-2025-64898 CVE record

CVSS 5.3 Medium

ColdFusion | Insufficiently Protected Credentials (CWE-522)
- Adobe ColdFusion
- Hard-coded credentials
Not analysed yet 9 Dec 2025
CVE-2025-61810 CVE record

CVSS 8.4 High

ColdFusion | Deserialization of Untrusted Data (CWE-502)
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 9 Dec 2025
CVE-2025-61809 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion
- CWE-20
Not analysed yet 9 Dec 2025
CVE-2025-61822 CVE record

CVSS 6.2 Medium

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion
- CWE-20
Not analysed yet 9 Dec 2025
CVE-2025-64897 CVE record

CVSS 5.6 Medium

ColdFusion | Improper Access Control (CWE-284)
- Adobe ColdFusion
- Broken access control
Not analysed yet 9 Dec 2025
CVE-2025-61823 CVE record

CVSS 6.2 Medium

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
Not analysed yet 9 Dec 2025
CVE-2025-61811 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion
- Path traversal
Not analysed yet 9 Dec 2025
CVE-2025-54261 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion
- Path traversal
Not analysed yet 9 Sept 2025
CVE-2025-54234 CVE record

CVSS 2.7 Low

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion
- Server-side request forgery (SSRF)
Not analysed yet 18 Aug 2025
CVE-2025-49542 CVE record

CVSS 5.2 Medium

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe ColdFusion
- Cross-site scripting (XSS)
Not analysed yet 8 Jul 2025
CVE-2025-49535 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
Not analysed yet 8 Jul 2025
CVE-2025-49536 CVE record

CVSS 7.3 High

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion
- Broken access control
Not analysed yet 8 Jul 2025
CVE-2025-49539 CVE record

CVSS 4.5 Medium

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
Not analysed yet 8 Jul 2025
CVE-2025-49545 CVE record

CVSS 6.2 Medium

ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)
- Adobe ColdFusion
- Server-side request forgery (SSRF)
Not analysed yet 8 Jul 2025
CVE-2025-49541 CVE record

CVSS 4.3 Medium

ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe ColdFusion
- Cross-site scripting (XSS)
Not analysed yet 8 Jul 2025
CVE-2025-49537 CVE record

CVSS 7.9 High

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe ColdFusion
- Command injection
Not analysed yet 8 Jul 2025
CVE-2025-49551 CVE record

CVSS 8.8 High

ColdFusion | Use of Hard-coded Credentials (CWE-798)
- Adobe ColdFusion
- Hard-coded credentials
Not analysed yet 8 Jul 2025
CVE-2025-49546 CVE record

CVSS 2.4 Low

ColdFusion | Improper Access Control (CWE-284)
- Adobe ColdFusion
- Broken access control
Not analysed yet 8 Jul 2025
CVE-2025-49544 CVE record

CVSS 6.8 Medium

ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)
- Adobe ColdFusion
- XML external entities (XXE)
Not analysed yet 8 Jul 2025
CVE-2025-49543 CVE record

CVSS 4.3 Medium

ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe ColdFusion
- Cross-site scripting (XSS)
Not analysed yet 8 Jul 2025
CVE-2025-49540 CVE record

CVSS 4.3 Medium

ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe ColdFusion
- Cross-site scripting (XSS)
Not analysed yet 8 Jul 2025
CVE-2025-49538 CVE record

CVSS 7.4 High

ColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91)
- Adobe ColdFusion
- Other injection
Not analysed yet 8 Jul 2025
CVE-2025-43565 CVE record

CVSS 8.4 HighCritical · CVSS 7+ and EPSS

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion
- Broken access control
Not analysed yet 13 May 2025
CVE-2025-43559 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion
- CWE-20
Not analysed yet 13 May 2025
CVE-2025-43562 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe ColdFusion
- Command injection
Not analysed yet 13 May 2025
CVE-2025-43566 CVE record

CVSS 6.8 Medium

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion
- Path traversal
Not analysed yet 13 May 2025
CVE-2025-43564 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion
- Broken access control
Not analysed yet 13 May 2025
CVE-2025-43560 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion
- CWE-20
Not analysed yet 13 May 2025
CVE-2025-43563 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion | Improper Access Control (CWE-284)
- Adobe ColdFusion
- Broken access control
Not analysed yet 13 May 2025
CVE-2025-43561 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion | Incorrect Authorization (CWE-863)
- Adobe ColdFusion
- Broken access control
Not analysed yet 13 May 2025
CVE-2025-30287 CVE record

CVSS 8.2 High

ColdFusion | Improper Authentication (CWE-287)
- Adobe ColdFusion
- Authentication bypass
Not analysed yet 8 Apr 2025
CVE-2025-30293 CVE record

CVSS 6.8 Medium

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion
- CWE-20
Not analysed yet 8 Apr 2025
CVE-2025-30292 CVE record

CVSS 6.1 Medium

ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe ColdFusion
- Cross-site scripting (XSS)
Not analysed yet 8 Apr 2025
CVE-2025-30290 CVE record

CVSS 8.7 HighCritical · CVSS 7+ and EPSS

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion
- Path traversal
Not analysed yet 8 Apr 2025
CVE-2025-30282 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ColdFusion | Improper Authentication (CWE-287)
- Adobe ColdFusion
- Authentication bypass
Not analysed yet 8 Apr 2025
CVE-2025-30284 CVE record

CVSS 8.4 High

ColdFusion | Deserialization of Untrusted Data (CWE-502)
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 8 Apr 2025
CVE-2025-30294 CVE record

CVSS 6.8 Medium

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion
- CWE-20
Not analysed yet 8 Apr 2025
CVE-2025-30289 CVE record

CVSS 8.2 High

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe ColdFusion
- Command injection
Not analysed yet 8 Apr 2025
CVE-2025-30288 CVE record

CVSS 8.2 High

ColdFusion | Improper Access Control (CWE-284)
- Adobe ColdFusion
- Broken access control
Not analysed yet 8 Apr 2025
CVE-2025-24446 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion
- CWE-20
Not analysed yet 8 Apr 2025
CVE-2025-24447 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

ColdFusion | Deserialization of Untrusted Data (CWE-502)
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 8 Apr 2025
CVE-2025-30281 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion | Improper Access Control (CWE-284)
- Adobe ColdFusion
- Broken access control
Not analysed yet 8 Apr 2025
CVE-2025-30291 CVE record

CVSS 5.5 Medium

ColdFusion | Information Exposure (CWE-200)
- Adobe ColdFusion
- Information disclosure
Not analysed yet 8 Apr 2025
CVE-2025-30285 CVE record

CVSS 8.4 HighCritical · CVSS 7+ and EPSS

ColdFusion | Deserialization of Untrusted Data (CWE-502)
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 8 Apr 2025
CVE-2025-30286 CVE record

CVSS 8.4 High

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- Adobe ColdFusion
- Command injection
Not analysed yet 8 Apr 2025
CVE-2024-53961 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- Adobe ColdFusion
- Path traversal
Not analysed yet 23 Dec 2024
CVE-2024-41874 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion | Deserialization of Untrusted Data (CWE-502)
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 13 Sept 2024
CVE-2024-45113 CVE record

CVSS 7.5 High

ColdFusion | Improper Authentication (CWE-287)
- Adobe ColdFusion
- Authentication bypass
Not analysed yet 13 Sept 2024
CVE-2024-34112 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

ColdFusion CFDOCUMENT file retrieval / access control bypass
- Adobe ColdFusion
- Broken access control
Not analysed yet 13 Jun 2024
CVE-2024-34113 CVE record

CVSS 5.5 Medium

ColdFusion | Weak Cryptography for Passwords (CWE-261)
- Adobe ColdFusion
- CWE-261
Not analysed yet 13 Jun 2024
CVE-2024-20767 CVE record

CVSS 7.4 HighCritical · KEV, CVSS 7+ and EPSSKEV

ColdFusion | Improper Access Control (CWE-284)
- Adobe ColdFusion
- Broken access control
Not analysed yet 18 Mar 2024
CVE-2023-44351 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Adobe ColdFusion RCE Security Vulnerability
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 17 Nov 2023
CVE-2023-44355 CVE record

CVSS 4.3 Medium

ColdFusion | Improper Input Validation (CWE-20)
- Adobe ColdFusion
- CWE-20
Not analysed yet 17 Nov 2023
CVE-2023-26347 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

CVE-2023-38205 issues | ColdFusion Admin Panel Access
- Adobe ColdFusion
- Broken access control
Not analysed yet 17 Nov 2023
CVE-2023-44352 CVE record

CVSS 6.1 Medium

Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version
- Adobe ColdFusion
- Cross-site scripting (XSS)
Not analysed yet 17 Nov 2023
CVE-2023-44353 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

ColdFusion WDDX Deserialization Gadgets
- Adobe ColdFusion
- Insecure deserialization
Not analysed yet 17 Nov 2023