CVE-2023-38205

CVE-2023-38205 affects Adobe ColdFusion: versions 2018u18 and earlier, 2021u8 and earlier, and 2023u2 and earlier are vulnerable to an Improper Access Control flaw that enables an unauthenticated attacker to bypass security and access the administration CFM/CFC endpoints without user interaction....

CVE-2023-29298

Adobe ColdFusion is affected by CVE-2023-29298, a unauthenticated Improper Access Control vulnerability that could bypass security features to reach the administration CFM/CFC endpoints. Affected versions include ColdFusion 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier....

CVE-2026-48282

CVE-2026-48282 affects Adobe ColdFusion 2025.9, 2023.20 and earlier. The connected exploit sources describe a path traversal in ColdFusion’s Remote Development Service (RDS) that allows an unauthenticated attacker to read and write arbitrary files via /CFIDE/main/ide.cfm, resulting in Remote Code...

CVE-2024-20767

CVE-2024-20767 affects Adobe ColdFusion 2023 (Update 6 and earlier) and 2021 (Update 12 and earlier) due to an Improper Access Control weakness that allows an attacker to perform an arbitrary file system read when the admin panel is internet-exposed. Multiple sources confirm public exploitation a...

CVE-2023-29300

CVE-2023-29300 is an Adobe ColdFusion deserialization of untrusted data vulnerability affecting ColdFusion 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier. The flaw allows arbitrary code execution without user interaction, via a network vector (CVSS v3.1: AV:N/AC:L/PR:N/U...

CVE-2023-38203

Adobe ColdFusion CVE-2023-38203 is a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution. Affected: ColdFusion 2018u17 and earlier, 2021u7 and earlier, 2023u1 and earlier. Exploitation does not require user interaction; CVSSv3.1 base score 9.8 (CRITICAL) wi...

CVE-2026-48316

CVE-2026-48316 affects Adobe ColdFusion versions 2025.9, 2023.20 and earlier and is an Improper Input Validation vulnerability that could enable arbitrary code execution in the current user context without user interaction. Remediation: update to ColdFusion 2023 Update 21 or ColdFusion 2025 Updat...

CVE-2024-41874

CVE-2024-41874 affects Adobe ColdFusion, specifically versions 2023.9, 2021.15 and earlier. The vulnerability is Deserialization of Untrusted Data (CWE-502) that could lead to arbitrary code execution in the context of the current user. Exploitation is unauthenticated and requires no user interac...

CVE-2023-26347

Adobe ColdFusion is affected by an Improper Access Control vulnerability (CVE-2023-26347) in versions 2023.5 and earlier and 2021.11 and earlier, enabling unauthenticated attackers to reach the administration CFM/CFC endpoints without user interaction. The issue is a security feature bypass via a...

CVE-2024-53961

CVE-2024-53961 affects Adobe ColdFusion 2023.11, 2021.17 and earlier, due to an improper limitation of a pathname to a restricted directory (path traversal) that can lead to arbitrary file-system reads. Impact per sources: potential disclosure of sensitive files or data outside the intended direc...

CVE-2023-44352

Adobe ColdFusion: Reflective XSS affecting 2023.5 (and earlier) and 2021.11 (and earlier). An unauthenticated user can lure a victim to a crafted URL that executes malicious JavaScript in the browser, potentially compromising session data. Affected component is the web interface that handles the ...

CVE-2023-44353

CVE-2023-44353 affects Adobe ColdFusion versions 2023.5 and earlier, and 2021.11 and earlier, due to a Deserialization of Untrusted Data vulnerability (WDDX) that could lead to arbitrary code execution without user interaction. Connected sources confirm the issue is a deserialization gadget class...

CVE-2025-24447

CVE-2025-24447 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The issue is a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution in the context of the current user, with a High impact on Confidentiality and Integrity . Exploitation ...

CVE-2023-38206

Adobe ColdFusion is affected by CVE-2023-38206: improper access control allowing an attacker to access administration CFM/CFC endpoints with no interaction, causing low confidentiality impact. Affected: ColdFusion versions 2018u18 and earlier, 2021u8 and earlier, 2023u2 and earlier. Exploitation ...

CVE-2023-38204

CVE-2023-38204 affects Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier, and 2023u2 and earlier. The vulnerability is a Deserialization of Untrusted Data issue that could lead to Arbitrary code execution, with no user interaction required. The root cause is unsafe deserialization...

CVE-2025-30285

CVE-2025-30285 involves deserialization of untrusted data in Adobe ColdFusion. Affected are ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The underlying issue can allow arbitrary code execution in the context of the current user, with a high-privilege attacker able to bypass protectio...

CVE-2025-30292

CVE-2025-30292 affects Adobe ColdFusion: versions 2023.12, 2021.18, 2025.0 and earlier are vulnerable to a reflected Cross-Site Scripting (XSS) issue. If a victim is convinced to visit a URL referencing a vulnerable page, malicious JavaScript can execute in the user’s browser context, potentially...

CVE-2023-44351

CVE-2023-44351 affects Adobe ColdFusion: Deserialization of Untrusted Data leading to Arbitrary Code Execution. Affected products/versions include ColdFusion 2023.5 and earlier and 2021.11 and earlier; exploitation does not require user interaction and is rated CRITICAL (CVSSv3.1: 9.8). The vulne...

CVE-2026-48318

CVE-2026-48318 affects ColdFusion with an improper limitation of a pathname to a restricted directory (path traversal) that could enable arbitrary file system reads. The vulnerability allows an attacker to access sensitive files outside the intended scope without user interaction; the CVSS 3.1 ve...

CVE-2026-48325

Affected product: ColdFusion. Vulnerability: Missing Authentication for Critical Function that could allow arbitrary code execution in the context of the current user without user interaction. Impact stated as CRITICAL (CVSS 3.1: AV Adjacent, AC Low, PR None, UI None; Scope Changed; CHANGED). Lik...

CVE-2025-30288

CVE-2025-30288 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The issue is an Improper Access Control that could allow a low-privileged, local attacker to bypass security protections and execute code, with exploitation requiring user interaction (victim action within the ...

CVE-2026-48285

CVE-2026-48285 affects ColdFusion versions 2025.9, 2023.20 and earlier. It describes a Server-Side Request Forgery (SSRF) that can bypass security features and grant unauthorized read access without user interaction. The Bug’s scope is reported as changed, and the CVSS v3.1 base score is 8.6 (HIG...

CVE-2023-44350

Adobe ColdFusion is affected by a Deserialization of Untrusted Data vulnerability (CWE-502) that can lead to Arbitrary Code Execution without user interaction. Affected products include ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier). The root cause is deserialization of untrus...

CVE-2026-48283

CVE-2026-48283 affects ColdFusion versions 2025.9, 2023.20 and earlier. The vulnerability is an Unrestricted Upload of File with Dangerous Type (CWE-434) that can lead to arbitrary code execution in the context of the current user. Exploitation requires no user interaction and is network‑visible;...

CVE-2025-30293

Adobe ColdFusion (versions 2025.0 and earlier, including 2023.12 and 2021.18) is affected by an Improper Input Validation vulnerability that could bypass security protections and allow unauthorized write access. Exploitation does not require user interaction and the impact scope is changed. Remed...

CVE-2025-30291

Adobe ColdFusion CVE-2025-30291 affects ColdFusion 2023.12, 2021.18, 2025.0 and earlier and is described as an Information Exposure vulnerability that could bypass security features. The NVD/CVE data indicate a local attacker with low privileges and no user interaction could access sensitive info...

CVE-2026-48362

Technical details for CVE-2026-48362 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2025-30286

CVE-2025-30286 affects Adobe ColdFusion—versions 2023.12, 2021.18, 2025.0 and earlier—with an OS Command Injection vulnerability that could enable arbitrary code execution by a high-privilege attacker, requiring user interaction. The root cause is improper neutralization of special elements used ...

CVE-2025-30289

CVE-2025-30289 concerns Adobe ColdFusion: versions 2025, 2023, 2021 (and earlier) are affected by an OS Command Injection due to improper neutralization of special elements in commands. The issue enables arbitrary code execution and requires a low-privileged, locally authenticated attacker with u...

CVE-2025-24446

Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by CVE-2025-24446 due to improper input validation, potentially allowing arbitrary code execution. Exploitation is described as requiring admin panel privileges with no user interaction, and the scope may be changed. Affe...

CVE-2025-30282

CVE-2025-30282 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier, due to an Improper Authentication vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation details are not described in the provided documents; the entry indicate...

CVE-2023-44355

Adobe ColdFusion is affected by CVE-2023-44355 (Improper Input Validation) across ColdFusion 2023.5 and earlier and 2021.11 and earlier. The issue can allow an unauthenticated attacker to bypass a security feature and impact a minor integrity aspect, with exploitation requiring user interaction. ...

CVE-2026-71384

Adobe ColdFusion is affected by CVE-2026-71384, an Incorrect Authorization vulnerability (CWE-863) that could bypass security features and grant unauthorized read/write access, potentially causing application denial-of-service. The vulnerable component is restricted to an administrative network z...

CVE-2025-30287

Adobe ColdFusion CVE-2025-30287 affects ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The issue is described as an Improper Authentication (CWE-287) vulnerability that could allow arbitrary code execution in the context of the current user. An attacker with local access and low privil...

CVE-2026-48332

CVE-2026-48332 describes a Server-Side Request Forgery (SSRF) in ColdFusion that can bypass security features and grant unauthorized read access. The vulnerability is exploitable by a low-privileged attacker over the network without user interaction; the attack scope is reported as CHANGED. The e...

CVE-2025-30281

CVE-2025-30281 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The vulnerability is an Improper Access Control that could allow a high-privilege, remote attacker to access or modify sensitive data and potentially execute arbitrary code without user interaction. The issue’s...

CVE-2025-30294

CVE-2025-30294 affects Adobe ColdFusion 2023.12, 2021.18, 2025.0 and earlier. Root cause: Improper Input Validation leading to a security feature bypass. Impact: high-privileged attacker could bypass protections and gain unauthorized read access; exploitation does not require user interaction. Af...

CVE-2026-34619

The CVE-2026-34619 entry affects ColdFusion versions 2023.18, 2025.6 and earlier. It describes an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability that could allow an attacker to access unauthorized files or directories outside intended restrictions. Expl...

CVE-2023-29301

CVE-2023-29301 affects Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier. It is an Improper Restriction of Excessive Authentication Attempts vulnerability that could result in a security feature bypass and could impact user confidentiality. Exploit...

CVE-2025-30284

CVE-2025-30284 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The issue is a Deserialization of Untrusted Data vulnerability that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction, and high privileges can be im...

CVE-2025-30290

Adobe ColdFusion is affected by a Path Traversal vulnerability (CVE-2025-30290) affecting versions 2023.12, 2021.18, 2025.0 and earlier. The root cause is improper limitation of a pathname to a restricted directory, enabling a high-privilege attacker to bypass security protections and gain unauth...

CVE-2025-43559

CVE-2025-43559 affects Adobe ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier and is due to Improper Input Validation, enabling arbitrary code execution in the context of the current user. Documents indicate a high-privileged attacker could bypass security mechanisms and execute code with...

CVE-2025-43564

Adobe ColdFusion (versions 2025.1, 2023.13, 2021.19 and earlier) is affected by an Improper Access Control vulnerability that can allow arbitrary file system read. The issue stems from improper access restrictions and could let a high-privileged attacker access or modify sensitive data without au...

CVE-2025-43560

Adobe ColdFusion is affected by CVE-2025-43560 (Improper Input Validation) across versions 2025.1, 2023.13, 2021.19 and earlier. The issue allows arbitrary code execution in the context of the current user without user interaction, with a high-privilege attacker capable of bypassing security mech...

CVE-2026-48307

CVE-2026-48307 affects ColdFusion versions 2025.9, 2023.20 and earlier and is a reflected Cross-Site Scripting vulnerability (CWE-79). An attacker can inject malicious scripts into a web page, potentially leading to arbitrary code execution in the context of the current user. Exploitation require...

CVE-2026-48313

Adobe ColdFusion versions 2025.9, 2023.20 and earlier are affected by a path traversal vulnerability (CWE-22) that allows an unauthenticated remote attacker to perform arbitrary file system read and limited write access outside the intended directory scope. No user interaction is required. The vu...

CVE-2025-43565

CVE-2025-43565 affects Adobe ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier, due to an Incorrect Authorization vulnerability. The issue could allow arbitrary code execution in the context of the current user and, per the NVD entry, a high-privileged attacker could bypass protections and...

CVE-2025-43566

Adobe ColdFusion is affected by CVE-2025-43566: an Improper Limitation of a Pathname to a Restricted Directory (path traversal) that could allow a high-privileged attacker to read arbitrary files, without user interaction. Affected versions include 2025.1, 2023.13, 2021.19 and earlier. The underl...

CVE-2024-34113

Adobe ColdFusion is affected by CVE-2024-34113 (Weak Cryptography for Passwords) affecting ColdFusion 2023u7, 2021u13 and earlier. The issue stems from insufficiently strong cryptographic algorithms or flawed implementation used for password protection, enabling potential decryption or guessing o...

CVE-2025-43563

CVE-2025-43563 affects Adobe ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier. It is an Improper Access Control vulnerability that could enable an attacker with high privileges to perform an arbitrary file system read, potentially accessing or modifying sensitive data. Exploitation requir...