CVE-2025-30290

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to a security feature bypass. A high privileged attacker could exploit this vulnerability to bypass security...

CVE-2025-30286

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could lead in arbitrary code execution by an attacker. A high-privileged attacker could leverage this vulnerabili...

CVE-2025-30284

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections...

CVE-2025-30282

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass authentication mechanisms and...

CVE-2025-24446

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution. Exploitation of this issue does not require user interaction, but admin panel privileges are required, and scope is changed...

CVE-2025-24447

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does...

CVE-2025-30287 ColdFusion | Improper Authentication (CWE-287)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A low privileged attacker with local access could leverage this vulnerability to bypass security...

CVE-2025-30287

Adobe ColdFusion CVE-2025-30287 affects ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The issue is described as an Improper Authentication (CWE-287) vulnerability that could allow arbitrary code execution in the context of the current user. An attacker with local access and low privil...

CVE-2025-30282 ColdFusion | Improper Authentication (CWE-287)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Authentication vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass authentication mechanisms and...

CVE-2025-30290

Adobe ColdFusion is affected by a Path Traversal vulnerability (CVE-2025-30290) affecting versions 2023.12, 2021.18, 2025.0 and earlier. The root cause is improper limitation of a pathname to a restricted directory, enabling a high-privilege attacker to bypass security protections and gain unauth...

CVE-2025-30284 ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections...

CVE-2025-30284

CVE-2025-30284 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The issue is a Deserialization of Untrusted Data vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction, and high privileges can be im...

CVE-2025-30294 ColdFusion | Improper Input Validation (CWE-20)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security protections and gain unauthorized read access...

CVE-2025-30294

CVE-2025-30294 affects Adobe ColdFusion 2023.12, 2021.18, 2025.0 and earlier. Root cause: Improper Input Validation leading to a security feature bypass. Impact: high-privileged attacker could bypass protections and gain unauthorized read access; exploitation does not require user interaction. Af...

CVE-2025-24446

Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by CVE-2025-24446 due to improper input validation, potentially allowing arbitrary code execution. Exploitation is described as requiring admin panel privileges with no user interaction, and the scope may be changed. Affe...

CVE-2025-24446 ColdFusion | Improper Input Validation (CWE-20)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution. Exploitation of this issue does not require user interaction, but admin panel privileges are required, and scope is changed...

CVE-2025-24447 ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user resulting in a High impact to Confidentiality and Integrity. Exploitation of this issue does...

CVE-2025-24447

CVE-2025-24447 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The issue is a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution in the context of the current user, with a High impact on Confidentiality and Integrity . Exploitation ...

CVE-2025-30285

CVE-2025-30285 involves deserialization of untrusted data in Adobe ColdFusion. Affected are ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The underlying issue can allow arbitrary code execution in the context of the current user, with a high-privilege attacker able to bypass protectio...

CVE-2025-30285 ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections...