CVE-2025-61813

CVE-2025-61813 concerns Adobe ColdFusion where an Improper Restriction of XML External Entity Reference (XXE) could allow reading arbitrary files from the server. Affected versions include ColdFusion 2025.4, 2023.16, 2021.22 and earlier. Exploitation: network vector, no user interaction required;...

CVE-2025-61821 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and data on the server. Explo...

CVE-2025-61821

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and data on the server. Explo...

CVE-2025-64898 ColdFusion | Insufficiently Protected Credentials (CWE-522)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by exploiting improperly stored or...

CVE-2025-64898 ColdFusion | Insufficiently Protected Credentials (CWE-522)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by exploiting improperly stored or...

CVE-2025-64898

Adobe ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could allow limited unauthorized write access without user interaction. The CVE-2025-64898 entry is corroborated by multiple sources and advisories in the conn...

CVE-2025-61810 ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted...

CVE-2025-61810 ColdFusion | Deserialization of Untrusted Data (CWE-502)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted...

CVE-2025-61810

CVE-2025-61810 affects Adobe ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. The root cause is a Deserialization of Untrusted Data vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation described: an attacker with high privileges can tri...

CVE-2025-61822 ColdFusion | Improper Input Validation (CWE-20)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could exploit this vulnerability to write malicious files to arbitrary locations on the file system. Exploitation of this...

CVE-2025-64897 ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access potentially resulting in denial of service...

CVE-2025-64897 ColdFusion | Improper Access Control (CWE-284)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access potentially resulting in denial of service...

CVE-2025-64897

CVE-2025-64897 affects Adobe ColdFusion 2025.4, 2023.16, 2021.22 and earlier; the issue is Improper Access Control enabling a low-privileged, local attacker to bypass security and gain limited unauthorized write access, potentially causing denial of service. Exploitation requires user interaction...

CVE-2025-61822

CVE-2025-61822 is an Adobe ColdFusion vulnerability (improper input validation) affecting ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier. The issue could allow an attacker to write arbitrary files to the filesystem without user interaction and with changed scope. Public notices in the c...

CVE-2025-61823

Adobe ColdFusion is affected by CVE-2025-61823: an Improper Restriction of XML External Entity Reference (XXE) vulnerability allows a high-privilege attacker to read arbitrary files on the server. The issue affects ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier, with exploitation requir...

CVE-2025-61823 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on th...

CVE-2025-61823 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on th...

CVE-2025-61811 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could leverage this vulnerability to bypass security measures and execute...

CVE-2025-61811 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could leverage this vulnerability to bypass security measures and execute...

EUVD-2025-202328

Creative Cloud Desktop versions 6.4.0.361 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to disrupt the application's functionality by...