Adobe Coldfusion vulnerabilities

CVE-2015-0345 [MEDIUM] CWE-79 CVE-2015-0345: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Updat Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2015-8052 [MEDIUM] CWE-79 CVE-2015-8052: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Updat Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8053.

CVE-2015-8053 [MEDIUM] CVE-2015-8053: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Updat Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-8052.

CVE-2009-1876 [MEDIUM] CVE-2009-1876: Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspeci Adobe ColdFusion 8.0.1 and earlier might allow attackers to obtain sensitive information via unspecified vectors, related to a "double-encoded null character vulnerability."

CVE-2014-0571 [MEDIUM] CWE-79 CVE-2014-0571: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Upda Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2025-49539 [MEDIUM] CWE-611 CVE-2025-49539: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information. Exploitation of this issue does not require user interacti

CVE-2012-2048 [MEDIUM] CVE-2012-2048: Unspecified vulnerability in Adobe ColdFusion 10 and earlier allows attackers to cause a denial of s Unspecified vulnerability in Adobe ColdFusion 10 and earlier allows attackers to cause a denial of service via unknown vectors.

CVE-2011-0734 [MEDIUM] CWE-79 CVE-2011-0734: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attacke Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element, related to a "tag body" attack. NOTE: this was originally reported as affecting 9.0.1 CHF1 and earlier.

CVE-2011-0581 [MEDIUM] CWE-20 CVE-2011-0581: Multiple CRLF injection vulnerabilities in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers Multiple CRLF injection vulnerabilities in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified tags.

CVE-2011-0737 [MEDIUM] CWE-200 CVE-2011-0737: Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error message. NOTE: the vendor disputes the significance of this issue because the Site-wide Error Handler and Debug Output Settings sections of the ColdFusion Lockdown guide explai

CVE-2006-4724 [MEDIUM] CVE-2006-4724: Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 Unspecified vulnerability in the ColdFusion Flash Remoting Gateway in Adobe ColdFusion MX 7 and 7.01 allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors involving a crafted command.

CVE-2011-0735 [MEDIUM] CWE-79 CVE-2011-0735: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attacke Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via vectors involving a "tag script."

CVE-2011-0583 [MEDIUM] CWE-79 CVE-2011-0583: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attacke Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via the cfform tag.

CVE-2011-0580 [MEDIUM] CWE-79 CVE-2011-0580: Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Adobe ColdFusion Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Adobe ColdFusion 8.0 through 9.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-5315 [MEDIUM] CWE-79 CVE-2014-5315: Cross-site scripting (XSS) vulnerability in the Help page in Adobe Acrobat 9.5.2 and earlier and Col Cross-site scripting (XSS) vulnerability in the Help page in Adobe Acrobat 9.5.2 and earlier and ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2010-1293 [MEDIUM] CWE-79 CVE-2010-1293: Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, a Cross-site scripting (XSS) vulnerability in the Administrator page in Adobe ColdFusion 8.0, 8.0.1, and 9.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2011-4368 [MEDIUM] CWE-79 CVE-2011-4368: Cross-site scripting (XSS) vulnerability in Remote Development Services (RDS) in Adobe ColdFusion 8. Cross-site scripting (XSS) vulnerability in Remote Development Services (RDS) in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-0572 [MEDIUM] CWE-264 CVE-2014-0572: Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Upda Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows local users to bypass intended IP-based access restrictions via unspecified vectors.

CVE-2025-49540 [MEDIUM] CWE-79 CVE-2025-49540: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripti ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field,

CVE-2025-49543 [MEDIUM] CWE-79 CVE-2025-49543: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripti ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field,