CVE-2025-49539

CVE-2025-49539 concerns Adobe ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier affected by an XML External Entity (XXE) vulnerability that can bypass security features and leak sensitive information. The issue is caused by improper restriction of XML external entities, enabling a high-pri...

CVE-2025-49539 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information...

CVE-2025-49539 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information...

CVE-2025-49545

Adobe ColdFusion is affected by CVE-2025-49545 (SSRF leading to arbitrary file system read) in versions 2025.2, 2023.14, 2021.20 and earlier. A high-privilege authenticated attacker can force the application to make arbitrary requests by URL injection; exploitation requires no user interaction an...

CVE-2025-49545 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of URLs. Exploitation...

CVE-2025-49545 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of URLs. Exploitation...

CVE-2025-49541 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2025-49541 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2025-49541

CVE-2025-49541 – Adobe ColdFusion : Stored XSS affecting ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier. The vulnerability allows a high-privilege attacker to inject malicious scripts into vulnerable form fields, with malicious JavaScript potentially executed in a victim’s browser when ...

CVE-2025-49537 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user...

CVE-2025-49537

CVE-2025-49537 concerns Adobe ColdFusion. Affected are ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier, where an OS Command Injection flaw could allow arbitrary code execution by a high-privileged attacker. Exploitation requires user interaction, and the vulnerable component is restricte...

CVE-2025-49537 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user...

CVE-2025-49537

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead to arbitrary code execution by a high-privileged attacker. Exploitation of this issue requires user...

CVE-2025-49551 ColdFusion | Use of Hard-coded Credentials (CWE-798)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Use of Hard-coded Credentials vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized access to sensitive systems or data. Exploitation of this issue does...

CVE-2025-49551

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Use of Hard-coded Credentials vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized access to sensitive systems or data. Exploitation of this issue does...

CVE-2025-49551 ColdFusion | Use of Hard-coded Credentials (CWE-798)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Use of Hard-coded Credentials vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized access to sensitive systems or data. Exploitation of this issue does...

CVE-2025-49551

CVE-2025-49551 affects Adobe ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier. The issue is described as Use of Hard-coded Credentials, enabling privilege escalation with unauthorized access to sensitive systems/data. Exploitation reportedly requires no user interaction and is limited to ...

CVE-2025-49546

CVE-2025-49546 affects Adobe ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier with an Improper Access Control that can lead to a partial application denial-of-service. A high-privileged attacker could disrupt availability without user interaction, and the vulnerable component is restricte...

CVE-2025-49546 ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. A high-privileged attacker could exploit this vulnerability to partially disrupt the availability of the application...

CVE-2025-49546 ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. A high-privileged attacker could exploit this vulnerability to partially disrupt the availability of the application...