Adobe Coldfusion vulnerabilities

CVE-2013-1388 [HIGH] CVE-2013-1388: Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 bef Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain administrator-console access via unknown vectors.

CVE-2013-1387 [HIGH] CVE-2013-1387: Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 bef Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors.

CVE-2026-48375 [MEDIUM] CWE-863 CVE-2026-48375: ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an applicati ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service. A low-privileged attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2007-5905 [MEDIUM] CWE-255 CVE-2007-5905: Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that Adobe ColdFusion 8 and MX 7 allows remote attackers to hijack sessions via unspecified vectors that trigger establishment of a session to a ColdFusion application in which the (1) CFID or (2) CFTOKEN cookies have empty values, possibly due to a session fixation vulnerability.

CVE-2020-9672 [HIGH] CWE-426 CVE-2020-9672: Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versi Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.

CVE-2020-9673 [HIGH] CWE-426 CVE-2020-9673: Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versi Adobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier versions have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.

CVE-2020-3768 [HIGH] CWE-426 CVE-2020-3768: ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerabi ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation.

CVE-2025-49544 [MEDIUM] CWE-611 CVE-2025-49544: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or bypass security measures. Exploitation of this issue doe

CVE-2025-61823 [MEDIUM] CWE-611 CVE-2025-61823: ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. A high privileged attacker could exploit this vulnerability to access sensitive files and data on the server. Exploitation of this issue requires user in

CVE-2008-1656 [HIGH] CVE-2008-1656: Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, wh Adobe ColdFusion 8 and 8.0.1 does not properly implement the public access level for CFC methods, which allows remote attackers to invoke these methods via Flex 2 remoting, a different vulnerability than CVE-2006-4725.

CVE-2026-48376 [MEDIUM] CWE-116 CVE-2026-48376: is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Secur is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user inte

CVE-2018-15963 [MEDIUM] CVE-2018-15963: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary folder creation.

CVE-2020-3796 [MEDIUM] CVE-2020-3796: ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an improper access control vulnerabili ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an improper access control vulnerability. Successful exploitation could lead to system file structure disclosure.

CVE-2006-5858 [MEDIUM] CWE-200 CVE-2006-5858: Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers Adobe ColdFusion MX 7 through 7.0.2, and JRun 4, when run on Microsoft IIS, allows remote attackers to read arbitrary files, list directories, or read source code via a double URL-encoded NULL byte in a ColdFusion filename, such as a CFM file.

CVE-2025-64898 [MEDIUM] CWE-522 CVE-2025-64898: ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access. An attacker could leverage this vulnerability to gain unauthorized access by exploiting improperly stored or transmitted credentials. Exploitation of this issue does no

CVE-2018-15962 [MEDIUM] CWE-200 CVE-2018-15962: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulnerability. Successful exploitation could lead to information disclosure.

CVE-2025-61822 [MEDIUM] CWE-20 CVE-2025-61822: ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validatio ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could exploit this vulnerability to write malicious files to arbitrary locations on the file system. Exploitation of this issue does not require user interaction and scope is c

CVE-2023-38206 [MEDIUM] CWE-284 CVE-2023-38206: Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are a Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints resulting in a low-confidentiality impact. Exploitatio

CVE-2020-3767 [MEDIUM] CWE-20 CVE-2020-3767: ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulne ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability. Successful exploitation could lead to application-level denial-of-service (dos).

CVE-2016-1115 [MEDIUM] CWE-20 CVE-2016-1115: Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildca Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.