PT-2026-113422

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description An incorrect authorization issue allows a low-privileged attacker to execute arbitrary code in the context of the current user. This process does not require user interaction, although...

CVE-2026-105899: Unrestricted Upload of File with Dangerous Type

ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user...

PT-2026-113382

🚨 CVE-2026-75995 ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. The vulnerable component is restrict...

CVE-2026-34633: Server-Side Request Forgery (SSRF)

ColdFusion is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is...

PT-2026-113380

🚨 CVE-2026-75748 ColdFusion is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user...

PT-2026-113437

ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not...

PT-2026-113362

Name of the Vulnerable Software and Affected Versions ColdFusion affected versions not specified Description An Incorrect Authorization issue allows a low-privileged attacker to bypass security measures and obtain unauthorized write access. This security feature bypass does not require any user...

PT-2026-113426

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions prior to 2025.0.13 Adobe ColdFusion versions prior to 2023.0.25 Description A Server-Side Request Forgery SSRF flaw allows unauthenticated attackers to escalate privileges and access internal services. This issue does...

CVE-2026-105903: Improper Control of Generation of Code

ColdFusion is affected by an Improper Control of Generation of Code 'Code Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue doe...

Adobe ColdFusion 9.0.1 Directory Traversal

Adobe ColdFusion versions 9.0.1 and earlier contain a directory traversal vulnerability in administrator pages that allows remote file reads through the locale parameter. The supplied Docker environment and proof of concept demonstrate CVE-2010-2861. https://packetstorm.news/download/235024...

Adobe ColdFusion RDS Auth Bypass (CVE-2013-0632)

Exploits CVE-2013-0632 in Adobe ColdFusion: empty adminpassword with rdsPasswordAllowed=1 on administrator.cfc?method=login yields CF admin session. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion RDS auth bypass CVE-2013-0632.""" import re from kittysploit import from...

Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to 1 CFIDE/administrator/settings/mappings.cfm, 2 logging/settings.cfm, 3 datasources/index.cfm, 4...

ColdFusion Code Execution

The vulnerability of the ColdFusion software platform lies in the lack of measures taken to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Adobe ColdFusion - Access Control Bypass

An attacker is able to access every CFM and CFC endpoint within the ColdFusion Administrator path /CFIDE/, of which there are 437 CFM files and 96 CFC files in a ColdFusion 2021 Update 6 install. id: CVE-2023-29298 info: name: Adobe ColdFusion - Access Control Bypass author:...

Adobe ColdFusion - Unrestricted File Upload Remote Code Execution

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution. id: CVE-2018-15961 info: name: Adobe ColdFusion - Unrestricted File Upload...

ColdFusion Privilege Escalation

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

ColdFusion Code Execution

The vulnerability of the ColdFusion software platform lies in the lack of measures taken to neutralize instructions in dynamically executed code. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ColdFusion SQL Injection Code Execution

The vulnerability of the ColdFusion software platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ColdFusion Access Control File Read

The vulnerability of the ColdFusion software platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to read arbitrary files remotely...

ColdFusion Code Execution

The vulnerability of the ColdFusion software platform is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...