CVE-2008-1656

Adobe ColdFusion 8 and 8.0.1 are affected by CVE-2008-1656, where the public access level for CFC methods is not properly enforced, enabling remote invocation of restricted functions via Flex 2 remoting. The root cause is inadequate access control for CFC methods; impact is remote access to funct...

CVE-2013-1387

Adobe ColdFusion is affected by multiple vulnerabilities addressed in APSB13-10 (CVE-2013-1387 and CVE-2013-1388). Affected products include ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9. For CVE-2013-1387, an unspecified user impersonation ...

CVE-2013-3349

Adobe ColdFusion 9.0–9.0.2 running on the JRun application server is affected by an unspecified remote DoS vulnerability (CVE-2013-3349). The issue, disclosed in APSB13-19, allows an attacker to cause the ColdFusion server to crash via unknown vectors. Remediation is to apply the hotfixes describ...

CVE-2015-5255

CVE-2015-5255 describes a Server-Side Request Forgery (SSRF) in BlazeDS used with Adobe ColdFusion and LiveCycle Data Services. A crafted XML document could cause BlazeDS to send HTTP requests to intranet servers, bypassing access controls and enabling further host‑based attacks. Affected product...

CVE-2016-1113

CVE-2016-1113 affects Adobe ColdFusion 10 (before Update 19), 11 (before Update 8), and 2016 (before Update 1). The vulnerability is an XSS flaw caused by insufficient input validation that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Connected sources a...

CVE-2018-15962

Adobe ColdFusion is affected by a directory listing vulnerability (CVE-2018-15962). Impacted are ColdFusion 2016 Update 6 and earlier, the 2018-07-12 release (2018.0.0.310739) and Update 14 and earlier, and ColdFusion 11 Update 14 and earlier. Successful exploitation could disclose sensitive info...

CVE-2021-40699

CVE-2021-40699 affects Adobe ColdFusion 2021 update 1 and earlier and ColdFusion 2018.10 and earlier. The issue is an improper access control in the CFIDE path that could let an authenticated attacker access and manipulate arbitrary data in the environment. The vulnerability is mapped to a high s...

CVE-2024-34113

Adobe ColdFusion is affected by CVE-2024-34113 (Weak Cryptography for Passwords) affecting ColdFusion 2023u7, 2021u13 and earlier. The issue stems from insufficiently strong cryptographic algorithms or flawed implementation used for password protection, enabling potential decryption or guessing o...

CVE-2025-43565

CVE-2025-43565 affects Adobe ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier, due to an Incorrect Authorization vulnerability. The issue could allow arbitrary code execution in the context of the current user and, per the NVD entry, a high-privileged attacker could bypass protections and...

CVE-2022-38419

CVE-2022-38419 affects Adobe ColdFusion Update 14 (and earlier) and Update 4 (and earlier) with an XML External Entity (XXE) vulnerability that could cause arbitrary file system reads. Exploitation requires no user interaction. Public records highlight a fix path via APSB22-44 security updates fo...

CVE-2026-48315

Summary: CVE-2026-48315 affects ColdFusion versions 2025.9, 2023.20 and earlier. It is described as an Improper Input Validation vulnerability that could lead to arbitrary code execution in the context of the current user. An attacker could inject malicious scripts into a web page, potentially ga...

CVE-2006-3978

The CVE-2006-3978 entry covers an unspecified vulnerability in a Verity third‑party library used by Adobe ColdFusion MX 7 through MX 7.0.2 (and possibly other products). The vulnerability is described as allowing local users to execute arbitrary code via unknown attack vectors, i.e., a local priv...

CVE-2006-5860

CVE-2006-5860 is an XSS vulnerability affecting Adobe JRun 4.0 in its administrator console as used with ColdFusion. The available connected sources confirm the flaw allows an attacker to inject arbitrary web script or HTML into the admin browser session, via unknown vectors. The JVN entry additi...

CVE-2011-0582

Adobe ColdFusion 8.0–9.0.1 administrator console contains an information-disclosure vulnerability (CVE-2011-0582). The connected Nessus entry (APSB11-04) aligns on multiple ColdFusion vulnerabilities, including this CVE, but the documents do not specify the root cause, affected subcomponents, or ...

CVE-2017-11286

CVE-2017-11286 – Adobe ColdFusion XXE vulnerability in XML parsing affects ColdFusion 2016 Update 4 and earlier, and ColdFusion 11 Update 12 and earlier. The root cause is an XML External Entity (XXE) injection that could enable sensitive data disclosure via crafted XML input. Public advisories (...

CVE-2018-4942

Adobe ColdFusion is affected by CVE-2018-4942 (Unsafe XML External Entity Processing) causing information disclosure. Affected: ColdFusion 5 and earlier; ColdFusion 11 Update 13 and earlier. Root cause: insecure XML parsing/XE. Mitigation: apply updates later than Update 5 (CF 5 and earlier) or l...

CVE-2020-3767

CVE-2020-3767 applies to Adobe ColdFusion 2016 (updates up to 15) and ColdFusion 2018 (updates up to 9). The issue is an insufficient input validation vulnerability that could cause an application‑level DoS. Public sources in the connected set confirm the affected products and the root cause, wit...

CVE-2020-3794

CVE-2020-3794 affects Adobe ColdFusion 2016 and 2018. The issue is a file inclusion vulnerability that could allow an attacker to execute arbitrary code by loading files located in the webroot or its subdirectories. Public advisories and vendor listings (NVD, Red Hat, CNVD, CVE records, and APSB2...

CVE-2025-43563

CVE-2025-43563 affects Adobe ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier. It is an Improper Access Control vulnerability that could enable an attacker with high privileges to perform an arbitrary file system read, potentially accessing or modifying sensitive data. Exploitation requir...

CVE-2008-4831

The CVE-2008-4831 entry concerns Adobe ColdFusion 8, 8.0.1, and ColdFusion MX 7.0.2, where a local user can bypass sandbox restrictions to access sensitive information or gain privileges. The exact vectors and root cause are not detailed in the provided documents, but the vulnerability is describ...

CVE-2011-2091

CVE-2011-2091 affects Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1. The vulnerability is described as unspecified and leads to denial of service via unknown vectors. The connected materials confirm the affected versions and DoS impact but do not provide concrete root-cause details, exploitable vec...

CVE-2011-4368

CVE-2011-4368 concerns an XSS flaw in Adobe ColdFusion’s Remote Development Services (RDS) affecting ColdFusion 8.0–9.0.1. The vulnerability enables remote attackers to inject arbitrary script/HTML in victims’ browsers, via unspecified vectors, within the context of the affected web application. ...

CVE-2012-2041

CVE-2012-2041 describes a CRLF injection in the Component Browser of Adobe ColdFusion 8.0–9.0.1 , enabling remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via unspecified vectors. Public references point to Adobe’s APSB12-15 security bulletin, which provided ...

CVE-2026-48364

CVE-2026-48364 affects ColdFusion versions 2025.9, 2023.20 and earlier. It is an Uncontrolled Search Path Element vulnerability that could enable arbitrary code execution in the context of the current user. Exploitation requires user interaction (victim must open a malicious file); the impact is ...

CVE-2010-0185

CVE-2010-0185 concerns the default configuration of Adobe ColdFusion 9.0 with the Solr Service. The issue allows remote attackers to access collections created by Solr, leaking collection metadata, search information, and index data via an unspecified URL due to insufficient access restrictions o...

CVE-2014-0572

CVE-2014-0572 affects Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2. The issue is a security permissions problem that allows a local, unauthenticated user to bypass IP-based access restrictions. Connected sources ...

CVE-2019-8074

CVE-2019-8074 is a path traversal vulnerability in Adobe ColdFusion 2018 (update 4 and earlier) and ColdFusion 2016 (update 11 and earlier) that could bypass access controls in the context of the current user. NVD CVSS v3.1 base score 9.8 (CRITICAL) with network attack vector, no user interaction...

CVE-2020-3768

Adobe ColdFusion 2016 (pre-Update 15) and ColdFusion 2018 (pre-Update 9) are affected by CVE-2020-3768 due to a DLL search-order hijack that could enable local privilege escalation. The issue stems from DLL loading order on Windows; exploitation is local and could grant elevated privileges. Remed...

CVE-2020-9672

CVE-2020-9672 affects Adobe ColdFusion 2016 (update 15 and earlier) and ColdFusion 2018 (update 9 and earlier). The issue is a DLL search-order hijacking vulnerability that could lead to privilege escalation. Public documentation references vendor advisories APSB20-43 and related patches; remedia...

CVE-2022-35690

CVE-2022-35690 is a stack-based buffer overflow in the Adobe ColdFusion ODBC Agent affecting ColdFusion versions Update 14 and earlier and Update 4 and earlier. The issue is triggered by a crafted network packet and can lead to arbitrary code execution in the context of the current user without u...

CVE-2026-47928

CVE-2026-47928 affects ColdFusion versions 2023.19, 2025.8 and earlier. The issue is an Improper Input Validation vulnerability that could allow arbitrary code execution in the context of the current user . Exploitation is possible without user interaction, and the document set notes a scope chan...

CVE-2018-15964

CVE-2018-15964 affects Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier, due to a vulnerable component leading to information disclosure. CVSS indicates high confidentiality impact (C:H/I:N/A:N; network attack). The issue was among multi...

CVE-2020-3796

CVE-2020-3796 affects Adobe ColdFusion 2016 and ColdFusion 2018. The root cause is improper access control that could allow an attacker to disclose the underlying system file structure. Affected products include ColdFusion 2016 before update 15 and ColdFusion 2018 before update 9 (per APSB20-18 a...

CVE-2024-45113

CVE-2024-45113 affects ColdFusion versions 2023.6, 2021.12 and earlier, introducing an Improper Authentication vulnerability that can lead to privilege escalation. An attacker could gain unauthorized access without user interaction, with a network attack vector and no required privileges. The bas...

CVE-2026-48314

CVE-2026-48314 affects ColdFusion versions 2025.9, 2023.20 and earlier. The issue is an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) that could bypass security features, allowing an attacker to gain limited read and write access to files or directories outside the ...

CVE-2006-6483

Affected software : Adobe ColdFusion MX 7.x before 7.0.2. Vulnerability : improper sanitization of HTML tags when mitigating XSS, allowing a NULL byte (%00) in certain tags to bypass filters and inject arbitrary web script or HTML. Impact : remote attacker could execute script in the context of t...

CVE-2008-0644

Adobe ColdFusion MX 7.x (7.00, 7.01, 7.02) and ColdFusion 8 are affected by a cross‑site scripting bypass via the setEncoding function. The Seebug entry confirms remote attackers can trigger XSS through inadequate handling of CGI variables and setEncoding, with the impact being bypassed XSS prote...

CVE-2013-3350

Adobe ColdFusion 10 prior to Update 11 is vulnerable to a WebSockets-based issue that allows remote invocation of ColdFusion Components (CFC) public methods, exposing a risk of arbitrary method invocation on affected servers. Publicly documented behavior in multiple feeds points to remote access ...

CVE-2013-5328

CVE-2013-5328 affects Adobe ColdFusion 10 before Update 12. It allows remote attackers to read arbitrary files via unspecified vectors. Public sources (NVD, Red Hat, and CISA) corroborate the fixed behavior via Adobe APSB13-27; remediation is to apply the hotfix/update (Update 12) to ColdFusion 1...

CVE-2011-0737

Adobe ColdFusion 9.0.1 CHF1 and earlier is affected by an information-disclosure vulnerability where an id=- query to a .cfm file can reveal the installation path in an error message. Root cause is not fully detailed beyond the error disclosure; vendor notes the issue is mitigated by the Site-wid...

CVE-2012-0770

Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 are affected by CVE-2012-0770 due to a flaw in how hash values are computed for form parameters, allowing remote attackers to trigger hash collisions and cause a denial of service (CPU consumption) with crafted requests. Remediation is available via the...

CVE-2015-8053

CVE-2015-8053 is an XSS vulnerability in Adobe ColdFusion, affecting ColdFusion 10 before Update 18 and ColdFusion 11 before Update 7. Remote attackers can inject arbitrary web script or HTML via unspecified vectors. The issue is documented under APSB15-29; affected versions should apply the corr...

CVE-2011-0584

CVE-2011-0584 refers to a session fixation vulnerability in Adobe ColdFusion 8.0 through 9.0.1 . The issue allows remote attackers to hijack web sessions via unspecified vectors, indicating an authentication/session management weakness that persists across affected ColdFusion versions. The vulner...

CVE-2018-15960

CVE-2018-15960 affects Adobe ColdFusion (2018 July 12 release and earlier 2018 updates; also ColdFusion 11 Update 14 and earlier/2016 Update 6 and earlier). The connected advisory CPAI-2019-0985 identifies CKEditor Directory Traversal in the ColdFusion CKEditor component, due to improper sanitiza...

CVE-2024-34112

Summary of CVE-2024-34112 : Adobe ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could allow an attacker to perform an arbitrary file system read and access sensitive files or data. Exploitation reportedly requires no user interaction...

CVE-2025-43561

Adobe ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could let a high-privileged attacker bypass authentication and execute arbitrary code in the context of the current user, with exploitation not requiring user interaction a...

CVE-2006-6482

CVE-2006-6482 affects Adobe ColdFusion MX7. The issue allows remote disclosure of sensitive information via URL requests: (1) requesting non-existent files (JWS, CFM, CFML, or CFC) causes error messages revealing the installation path; (2) accessing /CFIDE/administrator/login.cfm without a host c...

CVE-2007-5905

Adobe ColdFusion 8 and ColdFusion MX 7 are affected by a remote session-fixation vulnerability. The issue arises when established sessions in a ColdFusion application can be hijacked if CFID/CFTOKEN cookies are empty, enabling an attacker to impersonate a user. The CVE-2007-5905 entry lists these...

CVE-2009-1875

CVE-2009-1875 affects Adobe ColdFusion 8.0.1 and earlier. The connected sources confirm multiple cross-site scripting (XSS) vulnerabilities in ColdFusion, where the application fails to sanitize input in various requests (e.g., URL query strings) and can allow remote attackers to inject arbitrary...

CVE-2011-0583

Adobe ColdFusion 8.0–9.0.1 is affected by a cross-site scripting (XSS) vulnerability exposed through the cfform tag, enabling remote injection of arbitrary script or HTML. The issue is documented (CVE-2011-0583) across multiple sources (NVD, CVE lists) with no public details on exploit status or ...