CVE-2023-44355

Adobe ColdFusion is affected by CVE-2023-44355 (Improper Input Validation) across ColdFusion 2023.5 and earlier and 2021.11 and earlier. The issue can allow an unauthenticated attacker to bypass a security feature and impact a minor integrity aspect, with exploitation requiring user interaction. ...

CVE-2025-30282

CVE-2025-30282 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier, due to an Improper Authentication vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation details are not described in the provided documents; the entry indicate...

CVE-2022-35712

CVE-2022-35712 is a heap-based buffer overflow affecting Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier). The vulnerability can lead to arbitrary code execution in the context of the current user and is triggered by a crafted network packet sent to the server, with no...

CVE-2025-30287

Adobe ColdFusion CVE-2025-30287 affects ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The issue is described as an Improper Authentication (CWE-287) vulnerability that could allow arbitrary code execution in the context of the current user. An attacker with local access and low privil...

CVE-2026-48362

Technical details for CVE-2026-48362 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2019-8256

Adobe ColdFusion is affected by CVE-2019-8256 due to insecure inherited permissions of the default installation directory, enabling privilege escalation. Public details across connected sources indicate affected versions include ColdFusion installations older than 2018u7 (e.g.,

CVE-2022-38418

CVE-2022-38418 affects Adobe ColdFusion versions Update 14 and earlier, and Update 4 and earlier. The issue is an improper limitation of a pathname to a restricted directory (path traversal) that could allow arbitrary code execution in the context of the current user. Exploitation does not requir...

CVE-2026-48332

CVE-2026-48332 describes a Server-Side Request Forgery (SSRF) in ColdFusion that can bypass security features and grant unauthorized read access. The vulnerability is exploitable by a low-privileged attacker over the network without user interaction; the attack scope is reported as CHANGED. The e...

CVE-2019-7840

CVE-2019-7840 affects Adobe ColdFusion. The vulnerability is caused by deserialization of untrusted data in ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier, with the potential for arbitrary code execution on successful exploitation (impact: high). Public...

CVE-2007-0817

CVE-2007-0817 is a cross-site scripting vulnerability in Adobe ColdFusion web server. The issue stems from failing to sanitize the User-Agent HTTP header before displaying it on the error page, allowing remote attackers to inject arbitrary HTML/script. Some sources note potential session hijackin...

CVE-2013-1389

CVE-2013-1389 affects Adobe ColdFusion 10 and older 9.x versions (9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5) and allows remote code execution via unknown vectors. The root cause is an unspecified vulnerability that enables an attacker to run arbitrary code in the server ...

CVE-2019-7092

Adobe ColdFusion is affected by CVE-2019-7092 (XSS leading to information disclosure). The issue impacts ColdFusion 2018 (update 1 and earlier), 2016 (update 7 and earlier), and ColdFusion 11 (update 15 and earlier). The Root cause is cross-site scripting in the ColdFusion component. Remediation ...

CVE-2019-7816

CVE-2019-7816 affects Adobe ColdFusion: Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier. The issue is a file upload restriction bypass that could allow arbitrary code execution on a vulnerable system. The vulnerability is described across multiple sources in the Connected do...

CVE-2025-30294

CVE-2025-30294 affects Adobe ColdFusion 2023.12, 2021.18, 2025.0 and earlier. Root cause: Improper Input Validation leading to a security feature bypass. Impact: high-privileged attacker could bypass protections and gain unauthorized read access; exploitation does not require user interaction. Af...

CVE-2019-7091

CVE-2019-7091 is an Adobe ColdFusion deserialization vulnerability (deserialization of untrusted data) that allows arbitrary code execution. Affected products, per connected documents, are ColdFusion 2018 Update 1 and earlier, ColdFusion 2016 Update 7 and earlier, and ColdFusion 11 Update 15 and ...

CVE-2020-9673

CVE-2020-9673 affects Adobe ColdFusion 2016 (Update 15 and earlier) and ColdFusion 2018 (Update 9 and earlier) due to a DLL search-order hijacking vulnerability that could enable privilege escalation. Public sources corroborate that patches are released under APSB20-43, with advisories noting upd...

CVE-2025-30281

CVE-2025-30281 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The vulnerability is an Improper Access Control that could allow a high-privilege, remote attacker to access or modify sensitive data and potentially execute arbitrary code without user interaction. The issue’s...

CVE-2015-8052

Adobe ColdFusion is affected by CVE-2015-8052 (XSS). The vulnerability exists in ColdFusion 10 prior to Update 18 and ColdFusion 11 prior to Update 7, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The impact is cross-site scripting, enabling an attacker...

CVE-2022-38422

Adobe ColdFusion is affected by CVE-2022-38422, a path traversal information disclosure vulnerability in Update 14 and earlier and Update 4 and earlier. Root cause is Improper Limitation of a Pathname to a Restricted Directory, enabling unauthenticated remote attackers to disclose sensitive infor...

CVE-2022-38424

CVE-2022-38424 affects Adobe ColdFusion Update 14 and earlier and Update 4 and earlier. The issue is an improper limitation of a pathname to a restricted directory (path traversal) that could enable arbitrary file system write. Exploitation is described as requiring administrator privileges with ...

CVE-2023-29301

CVE-2023-29301 affects Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier. It is an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass and could impact user confidentiality. Exploit...

CVE-2019-8073

The CVE-2019-8073 issue affects Adobe ColdFusion: ColdFusion 2018 Update 4 and earlier and ColdFusion 2016 Update 11 and earlier are vulnerable to a command-injection via a vulnerable component that could allow arbitrary code execution in the context of the current user. The vulnerability is addr...

CVE-2026-34619

The CVE-2026-34619 entry affects ColdFusion versions 2023.18, 2025.6 and earlier. It describes an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability that could allow an attacker to access unauthorized files or directories outside intended restrictions. Expl...

CVE-2006-5858

CVE-2006-5858 affects Adobe ColdFusion MX 7–7.0.2 and JRun 4 when run on Microsoft IIS. The vulnerability allows remote attackers to read arbitrary files, list directories, or read source code by sending a double URL-encoded NULL byte in a ColdFusion filename (e.g., a .cfm file). This is a server...

CVE-2010-5290

Technical details for CVE-2010-5290 are not publicly available in the provided documents; none of the connected items describe affected products, versions, vectors, or remediation. Monitor for updates.

CVE-2018-15957

CVE-2018-15957 affects Adobe ColdFusion (2018 July 12 release 2018.0.0.310739; Update 6 and earlier; Update 14 and earlier) with a deserialization of untrusted data flaw that can lead to arbitrary code execution. Connected sources also reference explicit remediation: upgrade to ColdFusion 2018 Up...

CVE-2022-38421

Adobe ColdFusion (versions Update 14 and earlier, and Update 4 and earlier) is affected by a Path Traversal vulnerability that allows arbitrary code execution in the context of the current user. Exploitation requires administrator privileges (per the CVE description) and, per ZDI, authentication ...

CVE-2017-11285

CVE-2017-11285: Adobe ColdFusion XSS vulnerability in CFML processing. Affects ColdFusion 2016 Update 4 and earlier, and ColdFusion 11 Update 12 and earlier. Root cause is cross-site scripting due to improper input handling; exploitation leads to browser-script execution and potential information...

CVE-2025-30284

CVE-2025-30284 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The issue is a Deserialization of Untrusted Data vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction, and high privileges can be im...

CVE-2025-43564

Adobe ColdFusion (versions 2025.1, 2023.13, 2021.19 and earlier) is affected by an Improper Access Control vulnerability that can allow arbitrary file system read. The issue stems from improper access restrictions and could let a high-privileged attacker access or modify sensitive data without au...

CVE-2022-38420

CVE-2022-38420 affects Adobe ColdFusion Update 14 and earlier, and Update 4 and earlier. It is a Use of Hard-coded Credentials vulnerability that could cause application denial-of-service by granting access to start/stop arbitrary services; exploitation does not require user interaction. Widely c...

CVE-2022-38423

CVE-2022-38423 affects Adobe ColdFusion (versions Update 14 and earlier, Update 4 and earlier). It is a Path Traversal vulnerability that could disclose information by improper restriction of pathnames. Exploitation does not require user interaction but requires administrator privileges, per the ...

CVE-2025-30290

Adobe ColdFusion is affected by a Path Traversal vulnerability (CVE-2025-30290) affecting versions 2023.12, 2021.18, 2025.0 and earlier. The root cause is improper limitation of a pathname to a restricted directory, enabling a high-privilege attacker to bypass security protections and gain unauth...

CVE-2017-3008

CVE-2017-3008 affects Adobe ColdFusion: versions ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier are affected by a reflected cross-site scripting vulnerability due to insufficient input validation. This could allow an attacker to ...

CVE-2022-35711

CVE-2022-35711 affects Adobe ColdFusion Update 14 and earlier and Update 4 and earlier. It is a heap-based buffer overflow triggered by a crafted network packet, enabling arbitrary code execution in the context of the current user without user interaction. Publicly documented remediation is to ap...

CVE-2026-71384

Adobe ColdFusion is affected by CVE-2026-71384, an Incorrect Authorization vulnerability (CWE-863) that could bypass security features and grant unauthorized read/write access, potentially causing application denial-of-service. The vulnerable component is restricted to an administrative network z...

CVE-2025-43559

CVE-2025-43559 affects Adobe ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier and is due to Improper Input Validation, enabling arbitrary code execution in the context of the current user. Documents indicate a high-privileged attacker could bypass security mechanisms and execute code with...

CVE-2025-43560

Adobe ColdFusion is affected by CVE-2025-43560 (Improper Input Validation) across versions 2025.1, 2023.13, 2021.19 and earlier. The issue allows arbitrary code execution in the context of the current user without user interaction, with a high-privilege attacker capable of bypassing security mech...

CVE-2019-8072

CVE-2019-8072 affects Adobe ColdFusion 2018 (update 4 and earlier) and ColdFusion 2016 (update 11 and earlier). The flaw is a security bypass that could lead to information disclosure in the context of the current user. Connected sources also indicate remediation via upgrading to ColdFusion 2018 ...

CVE-2022-42340

Adobe ColdFusion is affected by CVE-2022-42340 due to an Improper Input Validation vulnerability that enables arbitrary file system reads. According to the connected advisories, the issue impacts ColdFusion versions prior to the security updates in APSB22-44 (notably older Update 14 and Update 4 ...

CVE-2022-42341

CVE-2022-42341 – Adobe ColdFusion XXE vulnerability . Affected: ColdFusion Update 14 (and earlier) and Update 4 (and earlier). Root cause: improper restriction of XML External Entity references (XXE) allowing an attacker to read arbitrary files on the server via XML processing. Impact: arbitrary ...

CVE-2014-5315

CVE-2014-5315 affects Adobe products via an XSS in the Help page. Affected: Adobe Acrobat <= 9.5.2 (Mac/Windows) and Adobe ColdFusion

CVE-2018-4938

CVE-2018-4938 affects Adobe ColdFusion Update 5 and earlier, and ColdFusion 11 Update 13 and earlier, due to an insecure library loading vulnerability that could lead to local privilege escalation. CVSS v3.1 base score 7.8 (HIGH) with LOCAL attack, LOW privileges required, no user interaction, an...

CVE-2020-10145

CVE-2020-10145 affects the Adobe ColdFusion installer on Windows, which fails to set a secure ACL on the default installation directory (e.g., C:\ColdFusion2021). This allows unprivileged users to place files in the ColdFusion install path, enabling privilege escalation. Exploitation details are ...

CVE-2026-48307

CVE-2026-48307 affects ColdFusion versions 2025.9, 2023.20 and earlier and is a reflected Cross-Site Scripting vulnerability (CWE-79). An attacker can inject malicious scripts into a web page, potentially leading to arbitrary code execution in the context of the current user. Exploitation require...

CVE-2013-1388

CVE-2013-1388 affects Adobe ColdFusion 9.0 (before Update 10), 9.0.1 (before Update 9), 9.0.2 (before Update 4), and 10 (before Update 9). The vulnerability allows an attacker to obtain access to the administrator console via unknown vectors. Public sources consistently describe an unspecified vu...

CVE-2025-43566

Adobe ColdFusion is affected by CVE-2025-43566: an Improper Limitation of a Pathname to a Restricted Directory (path traversal) that could allow a high-privileged attacker to read arbitrary files, without user interaction. Affected versions include 2025.1, 2023.13, 2021.19 and earlier. The underl...

CVE-2026-48284

Technical details on CVE-2026-48284 are not publicly available in the provided documents. Monitor for updates from Adobe/NVD/CVE sources for affected products, scope, and remediation.

CVE-2026-48313

Adobe ColdFusion versions 2025.9, 2023.20 and earlier are affected by a path traversal vulnerability (CWE-22) that allows an unauthenticated remote attacker to perform arbitrary file system read and limited write access outside the intended directory scope. No user interaction is required. The vu...

CVE-2008-1656

Adobe ColdFusion 8 and 8.0.1 are affected by CVE-2008-1656, where the public access level for CFC methods is not properly enforced, enabling remote invocation of restricted functions via Flex 2 remoting. The root cause is inadequate access control for CFC methods; impact is remote access to funct...