CVE-2011-0583

Adobe ColdFusion 8.0–9.0.1 is affected by a cross-site scripting (XSS) vulnerability exposed through the cfform tag, enabling remote injection of arbitrary script or HTML. The issue is documented (CVE-2011-0583) across multiple sources (NVD, CVE lists) with no public details on exploit status or ...

CVE-2012-5674

Adobe ColdFusion 10 on IIS is affected by an unspecified denial-of-service vulnerability before Update 5. The issue, limited to when IIS is used, allows DoS via unknown vectors and is addressed by applying Update 5 (or later). Affected product/version: ColdFusion 10 with IIS prior to Update 5; ro...

CVE-2018-15963

Adobe ColdFusion 2016 Update 6 and earlier, ColdFusion 11 Update 14 and earlier, and the July 12, 2018 release (2018.0.0.310739) are affected by CVE-2018-15963, a security bypass that could allow arbitrary folder creation. The vulnerability stems from a bypass in ColdFusion’s security controls an...

CVE-2018-15965

CVE-2018-15965 affects Adobe ColdFusion: deserialization of untrusted data in the July 12, 2018 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier. Root cause is insecure deserialization enabling arbitrary code execution. CVSS v3.0 base score 9.8 (CRITICAL); impact on conf...

CVE-2022-35710

CVE-2022-35710 affects Adobe ColdFusion Update 14 and earlier, and Update 4 and earlier, via a stack-based buffer overflow in the ODBC/ColdFusion server component triggered by a crafted network packet. This can lead to remote arbitrary code execution in the context of the current user, with no us...

CVE-2006-4725

Adobe ColdFusion MX 7 and 7.01 are affected by an issue that allows local users to bypass security restrictions and call components (CFC) within a sandbox from CFML templates located outside the sandbox. Affected product: ColdFusion MX 7/7.01. Underlying cause: sandbox bypass enabling access to C...

CVE-2010-1293

Adobe ColdFusion CVE-2010-1293 is an XSS vulnerability affecting the Admin page in ColdFusion 8.0, 8.0.1, and 9.0. The issue arises from improper sanitization in the administrative interface, notably input to cfadminUserId on /CFIDE/administrator/login.cfm when Separate user name and password aut...

CVE-2011-0735

Adobe ColdFusion before 9.0.1 CHF1 is vulnerable to cross-site scripting (XSS) via vectors involving a “tag script.” The issue allows remote attackers to inject arbitrary web script or HTML. The connected documents do not provide exploit details or remediation steps.

CVE-2011-0736

Adobe ColdFusion 9.0.1 CHF1 and earlier: when a web app uses a DBMS, remote attackers can cause information disclosure of database structure via an id=- query to a .cfm file. The vendor disputes severity; mitigation advised by ColdFusion Lockdown guide is proper Site-wide Error Handler and Debug ...

CVE-2012-5675

CVE-2012-5675 affects Adobe ColdFusion 9.0 through 9.0.2 and ColdFusion 10. The vulnerability is a sandbox-permission bypass in shared-hosting environments that allows local users to bypass intended sandbox restrictions via unspecified vectors. The available connected documents confirm the affect...

CVE-2015-0345

Adobe ColdFusion is affected by CVE-2015-0345, a cross-site scripting (XSS) vulnerability in ColdFusion 10 prior to Update 16 and ColdFusion 11 prior to Update 5. The advisory notes an input-validation weakness that allows remote attackers to inject arbitrary script/HTML via unspecified vectors, ...

CVE-2018-15959

CVE-2018-15959 describes an insecure deserialization vulnerability in Adobe ColdFusion. The issue affects ColdFusion versions released July 12, 2018 (2018.0.0.310739) and Update 6 and earlier, as well as Update 14 and earlier, where deserializing untrusted data can lead to arbitrary code executio...

CVE-2018-4940

Adobe ColdFusion 11.x prior to 11u14 and 2016.x prior to 2016u6 are affected by CVE-2018-4940, a cross-site scripting vulnerability that could lead to information disclosure. Root cause is an exploitable XSS in Update 5 and earlier ColdFusion versions. Mitigation: apply ColdFusion 11u14 or 2016u6...

CVE-2021-40698

CVE-2021-40698 affects Adobe ColdFusion 2021 update 1 and earlier, and 2018.10 and earlier. Root cause: use of an inherently dangerous function leading to a security feature bypass. Impact: an authenticated attacker could access and manipulate arbitrary data in the environment. Mitigation: apply ...

CVE-2026-25652

CVE-2026-25652 is an Incorrect Authorization vulnerability affecting Adobe ColdFusion (per APSB26-90). The issue allows a low-privileged attacker with local access to escalate privileges and perform unauthorized read and write actions. Exploitation does not require user interaction. The CVSS-like...

CVE-2026-47960

CVE-2026-47960 summary ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference (XXE) that could lead to an arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside th...

CVE-2007-1278

CVE-2007-1278 describes a denial-of-service vulnerability in the IIS connector used by Adobe JRun 4.0 Updater 6 and ColdFusion MX 6.1/7.0 Enterprise when deployed on Microsoft IIS 6. The issue arises from handling a request for a file in the JRun web root, which can allow remote attackers to caus...

CVE-2007-1874

CVE-2007-1874 affects Adobe ColdFusion MX 7 for Linux and Solaris. The vulnerability stems from insecure permissions on specific scripts and directories (including CFMX7DreamWeaverExtensions.mxp, CFReportBuilderInstaller.exe, .com.zerog.registry.xml, uninstall.lax, license.txt, Readme.htm, k2admi...

CVE-2011-0734

The CVE-2011-0734 entry describes a Cross-site scripting (XSS) vulnerability in Adobe ColdFusion prior to 9.0.1 CHF1, allowing remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element (a “tag body” attack). Affecte...

CVE-2014-0571

CVE-2014-0571 is a cross-site scripting (XSS) vulnerability in Adobe ColdFusion . The affected releases are: ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2. Attackers can exploit unspecified vectors to inject arbitrary w...

CVE-2025-43562

CVE-2025-43562 describes an OS Command Injection in Adobe ColdFusion affecting versions 2025.1, 2023.13, 2021.19 and earlier. The root cause is improper neutralization/validation of elements in commands, enabling arbitrary code execution in the context of the current user. Exploitation is possibl...

CVE-2009-1877

CVE-2009-1877 is described as a cross-site scripting (XSS) vulnerability affecting Adobe ColdFusion 8.0.1 and earlier. The connected sources confirm that ColdFusion in this era could be exploited to inject arbitrary web script or HTML via unspecified vectors, with related advisories and CVEs (e.g...

CVE-2018-15958

CVE-2018-15958 affects Adobe ColdFusion: the July 12, 2018 release (version 2018.0.0.310739) and Update 6 and earlier, plus Update 14 and earlier, are vulnerable to a deserialization of untrusted data that could lead to arbitrary code execution . The issue is part of a set of four critical deseri...

CVE-2018-4941

CVE-2018-4941 affects Adobe ColdFusion 11.x before 11u14 and 2016.x before 2016u6, where an exploitable Cross-Site Scripting vulnerability could lead to information disclosure. The issue is a ColdFusion Web UI/XSS flaw; the root cause is an unsafe script handling path leading to information discl...

CVE-2009-3467

CVE-2009-3467 affects Adobe ColdFusion 8.0, 8.0.1, and 9.0, with an unspecified method vulnerability enabling cross-site scripting that lets an attacker inject arbitrary script via unknown vectors. Public details indicate risk is tied to XSS in the ColdFusion server; the exact exploit vectors are...

CVE-2011-0581

CVE-2011-0581 affects Adobe ColdFusion 8.0–9.0.1 with multiple CRLF injection vulnerabilities in various tags that allow remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting. The provided connected documents confirm the affected product and the underlying issue (C...

CVE-2011-2463

CVE-2011-2463 is a cross-site scripting (XSS) vulnerability affecting Adobe ColdFusion 8.0 through 9.0.1, exploitable via vectors involving the cfform tag to inject arbitrary script/HTML into a user’s browser. Public sources describe multiple XSS issues in ColdFusion and confirm that Adobe releas...

CVE-2026-48320

CVE-2026-48320: ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. The issue enables injection of malicious scripts into a web page and is described as having a HIGH impact with confidentiality and integrity at risk, though availability is not affected. The vulnerable...

CVE-2006-4726

CVE-2006-4726 concerns a cross-site scripting (XSS) flaw in Adobe ColdFusion MX 6.1 through 7.02. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a ColdFusion error page. The NVD entry shows a low overall severity (CVSS v2 base s...

CVE-2008-0643

Adobe ColdFusion MX 7.x and ColdFusion 8 are affected by a cross-site scripting (XSS) vulnerability. The Seebug entry notes that if an application uses Application.cfm or Application.cfc with setEncoding, or if certain CGI variables are not properly filtered, remote attackers can inject arbitrary...

CVE-2011-0580

Adobe ColdFusion administrator console is affected (versions 8.0–9.0.1) by multiple XSS vulnerabilities (CVE-2011-0580). The issue permits remote attackers to inject arbitrary web script/HTML via unspecified vectors, as documented in sources referencing the admin console XSS across multiple advis...

CVE-2013-5326

CVE-2013-5326 is an XSS vulnerability in Adobe ColdFusion (affecting CF versions 9.0 up to Update 12, 9.0.1 up to Update 11, 9.0.2 up to Update 6, and 10 up to Update 12) that can be exploited by remote authenticated users via the logviewer/CFIDE directory. The issue allows injection of arbitrary...

CVE-2026-48322

Technical details (affected product/version, root cause specifics, impact, mitigations) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-71387

CVE-2026-71387 affects ColdFusion with an Incorrect Authorization vulnerability that can allow arbitrary code execution in the context of the current user. The issue is exploitable without user interaction and the vulnerable component is restricted to an administrative network zone by default. Th...

CVE-2014-0570

CVE-2014-0570 is a Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 that allows remote attackers to hijack the authentication of unspecified victims via unknown vect...

CVE-2016-1114

Adobe ColdFusion is vulnerable to remote code execution via deserialization of crafted Java objects tied to the Apache Commons Collections library. Affected products/versions: ColdFusion 10 before Update 19, ColdFusion 11 before Update 8, and ColdFusion 2016 before Update 1. The issue enables an ...

CVE-2016-1115

Adobe ColdFusion is affected by CVE-2016-1115 due to a wildcard handling flaw in X.509 certificate name fields, enabling MITM server spoofing via crafted certs. Affected products: ColdFusion 10 before Update 19, ColdFusion 11 before Update 8, and ColdFusion 2016 before Update 1. Root cause: impro...

CVE-2020-3761

CVE-2020-3761 affects Adobe ColdFusion 2016 and 2018, enabling remote file read from the ColdFusion install directory (arbitrary file read). According to NVD, CVSSv3.1 base score 7.5 (HIGH), with network access and no authentication required (no user interaction). Remediation: patch/update per AP...

CVE-2025-54261

Adobe ColdFusion is affected by CVE-2025-54261 due to an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) that could allow arbitrary code execution. Affected are ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier; the issue requires optional configurations to be ...

CVE-2026-48328

The CVE-2026-48328 entry concerns Adobe ColdFusion and describes an Improper Input Validation vulnerability (CWE-20) that can bypass security features and allow an unauthorized read-access with low privileges. The issue can be exploited without user interaction over the network, and the attack ve...

CVE-2026-48329

Technical details about CVE-2026-48329 are not publicly available in the provided documents. Monitor for updates from Adobe/NVD for affected products and remediation information.

CVE-2006-4724

CVE-2006-4724 affects the Flash Remoting Gateway of Adobe ColdFusion MX 7 and 7.01. The vulnerability allows remote attackers to cause a denial of service (infinite loop) via crafted, unspecified vectors. The available documents do not provide concrete exploit details, specific affected versions ...

CVE-2026-27305

Affected product: ColdFusion 2023.18, 2025.6 and earlier. Issue: Improper limitation of a pathname to a restricted directory (path traversal) that could lead to arbitrary file system read. Exploitation does not require user interaction. Impact: confidentiality of data could be exposed (High). Ini...

CVE-2008-1203

The CVE-2008-1203 issue affects Adobe ColdFusion 8 and ColdFusion MX7 where the administrator interface does not log failed authentication attempts, potentially enabling brute‑force attacks without detection. Connected sources also document related issues in the same family (e.g., other CVEs in C...

CVE-2009-1878

CVE-2009-1878 describes a session fixation vulnerability affecting Adobe ColdFusion 8.0.1 and earlier. The issue allows remote attackers to hijack web sessions via unspecified vectors. Provided records confirm the affected software version range and the high-level impact (session hijacking), but ...

CVE-2026-48440

CVE-2026-48440 affects Adobe ColdFusion due to a Heap-based Buffer Overflow . The issue could allow arbitrary code execution in the context of the current user . Exploitation depends on conditions beyond the attacker’s control and does not require user interaction. Current documents do not specif...

CVE-2012-2048

CVE-2012-2048 affects Adobe ColdFusion 10 and earlier. The vulnerability is described as an unspecified denial of service caused by unknown vectors, with impact listed as partial availability loss. The available Connected documents do not detail the exact root cause or exploit vectors. Remediatio...

CVE-2014-9166

CVE-2014-9166 affects Adobe ColdFusion 10 prior to Update 15 and ColdFusion 11 prior to Update 3, allowing a denial of service via unspecified vectors due to a resource-consumption issue. Exploitation details are not provided in the available documents. Remediation guidance points to applying hot...

CVE-2010-1294

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2006-5859

CVE-2006-5859 is a cross-site scripting vulnerability in Adobe ColdFusion MX 7.x (7.0 and 7.0.1) where Global Script Protection is not enabled. The vulnerability allows remote attackers to inject arbitrary HTML/JS via unknown vectors, with possible references to Linkdirect.cfm, Topnav.cfm, and We...