Adobe Coldfusion vulnerabilities

CVE-2025-49545 [MEDIUM] CWE-918 CVE-2025-49545: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forge ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of URLs. Exploitation of this issue does not require user interaction and

CVE-2024-34113 [MEDIUM] CWE-261 CVE-2024-34113: ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vu ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. This vulnerability arises due to the use of insufficiently strong cryptographic algorithms or flawed implementation that compromises the confidentiality of password data. An attacker could ex

CVE-2026-21269 [MEDIUM] CWE-79 CVE-2026-21269: ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVE-2014-0570 [MEDIUM] CWE-352 CVE-2014-0570: Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 befo Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2017-3008 [MEDIUM] CWE-79 CVE-2017-3008: Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Updat Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability.

CVE-2017-11285 [MEDIUM] CWE-79 CVE-2017-11285: Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and earlier v Adobe ColdFusion has a cross-site scripting (XSS) vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

CVE-2010-0185 [MEDIUM] CWE-264 CVE-2010-0185: The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have The default configuration of Adobe ColdFusion 9.0 does not restrict access to collections that have been created by the Solr Service, which allows remote attackers to obtain collection metadata, search information, and index data via a request to an unspecified URL.

CVE-2016-1113 [MEDIUM] CWE-79 CVE-2016-1113: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8 Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2007-1278 [MEDIUM] CVE-2007-1278: Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 an Unspecified vulnerability in the IIS connector in Adobe JRun 4.0 Updater 6, and ColdFusion MX 6.1 and 7.0 Enterprise, when using Microsoft IIS 6, allows remote attackers to cause a denial of service via unspecified vectors, involving the request of a file in the JRun web root.

CVE-2012-5674 [HIGH] CVE-2012-5674: Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services (IIS) is used, allows attackers to cause a denial of service via unknown vectors.

CVE-2015-5255 [MEDIUM] CWE-20 CVE-2015-5255: Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data S Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a

CVE-2011-0629 [MEDIUM] CWE-352 CVE-2011-0629: Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 allow Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

CVE-2018-4940 [MEDIUM] CWE-79 CVE-2018-4940: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure.

CVE-2018-4941 [MEDIUM] CWE-79 CVE-2018-4941: Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability. Successful exploitation could lead to information disclosure.

CVE-2009-1878 [MEDIUM] CWE-287 CVE-2009-1878: Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hija Session fixation vulnerability in Adobe ColdFusion 8.0.1 and earlier allows remote attackers to hijack web sessions via unspecified vectors.

CVE-2026-76000 [MEDIUM] CWE-400 CVE-2026-76000: ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to appl ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-76002 [MEDIUM] CWE-79 CVE-2026-76002: ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is ab ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

CVE-2007-1874 [HIGH] CVE-2007-1874: Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and direct Adobe ColdFusion MX 7 for Linux and Solaris uses insecure permissions for certain scripts and directories, which allows local users to execute arbitrary code or obtain sensitive information via the (1) CFMX7DreamWeaverExtensions.mxp, (2) CFReportBuilderInstaller.exe, (3) .com.zerog.registry.xml, (4) uninstall.lax, (5) license.txt, (6) Readme.htm, (7) .com.zerog

CVE-2019-7092 [MEDIUM] CWE-79 CVE-2019-7092: ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cro ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability. Successful exploitation could lead to information disclosure .

CVE-2016-4159 [MEDIUM] CWE-79 CVE-2016-4159: Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9 Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.