Adobe ColdFusion 2023
96 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-105897 | ≤ 2023.0.25 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | HIGH 8.6 | 0.7 % | ||
| CVE-2026-34633 | ≤ 2023.0.25 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | HIGH 7.7 | 0.5 % | ||
| CVE-2026-106616 | ≤ 2023.0.25 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | HIGH 8.6 | 0.5 % | ||
| CVE-2026-106618 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.8 | 0.1 % | ||
| CVE-2026-106622 | ≤ 2023.0.25 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | CRITICAL 10.0 | 0.8 % | ||
| CVE-2026-105994 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 7.7 | 0.3 % | ||
| CVE-2026-106619 | ≤ 2023.0.25 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 9.0 | 0.6 % | ||
| CVE-2026-106089 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.8 | 0.2 % | ||
| CVE-2026-106613 | ≤ 2023.0.25 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 8.8 | 0.8 % | ||
| CVE-2026-106624 | ≤ 2023.0.25 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) | CRITICAL 10.0 | 1.1 % | ||
| CVE-2026-106614 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 7.8 | 0.2 % | ||
| CVE-2026-75996 | ≤ 2023.0.25 | ColdFusion | Uncontrolled Resource Consumption (CWE-400) | HIGH 7.5 | 0.6 % | ||
| CVE-2026-106621 | ≤ 2023.0.25 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) | CRITICAL 9.1 | 0.9 % | ||
| CVE-2026-90530 | ≤ 2023.0.25 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | CRITICAL 9.3 | 0.3 % | ||
| CVE-2026-105898 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.2 | 0.1 % | ||
| CVE-2026-105903 | ≤ 2023.0.25 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) | CRITICAL 9.9 | 0.6 % | ||
| CVE-2026-75994 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | CRITICAL 9.6 | 0.3 % | ||
| CVE-2026-106090 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.8 | 0.1 % | ||
| CVE-2026-34634 | ≤ 2023.0.25 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | HIGH 8.6 | 0.4 % | ||
| CVE-2026-106620 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | CRITICAL 9.6 | 0.4 % | ||
| CVE-2026-76001 | ≤ 2023.0.25 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | HIGH 7.1 | 0.5 % | ||
| CVE-2026-106612 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | CRITICAL 9.9 | 0.5 % | ||
| CVE-2026-106615 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.8 | 0.2 % | ||
| CVE-2026-75995 | ≤ 2023.0.25 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 8.4 | 0.2 % | ||
| CVE-2026-75748 | ≤ 2023.0.25 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | HIGH 7.6 | 0.4 % | ||
| CVE-2026-105900 | ≤ 2023.0.25 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 7.5 | 0.7 % | ||
| CVE-2026-71385 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.4 | 0.3 % | ||
| CVE-2026-105901 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.8 | 0.2 % | ||
| CVE-2026-106623 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 7.5 | 0.4 % | ||
| CVE-2026-105899 | ≤ 2023.0.25 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) | CRITICAL 10.0 | 1.0 % | ||
| CVE-2026-106617 | ≤ 2023.0.25 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.8 | 0.2 % | ||
| CVE-2026-76002 | ≤ 23 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) | MEDIUM 6.1 | 0.4 % | ||
| CVE-2026-75746 | ≤ 23 | ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | CRITICAL 9.1 | 1.0 % | ||
| CVE-2026-76000 | ≤ 23 | ColdFusion | Uncontrolled Resource Consumption (CWE-400) | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-75998 | ≤ 23 | ColdFusion | Improper Access Control (CWE-284) | HIGH 7.5 | 0.8 % | ||
| CVE-2026-76190 | ≤ 23 | ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) | HIGH 8.6 | 0.8 % | ||
| CVE-2026-48273 | ≤ 23 | ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95) | CRITICAL 9.9 | 1.3 % | ||
| CVE-2026-75999 | ≤ 23 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 8.4 | 0.5 % | ||
| CVE-2026-75993 | ≤ 23 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) | HIGH 8.5 | 0.4 % | ||
| CVE-2026-83961 | ≤ 2023.0.22 | ColdFusion | Improper Authentication (CWE-287) | HIGH 7.1 | 0.4 % | ||
| CVE-2026-71387 | ≤ 2023.0.22 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.8 | 0.5 % | ||
| CVE-2026-48385 | ≤ 2023.0.22 | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | HIGH 7.7 | 1.6 % | ||
| CVE-2026-71383 | ≤ 2023.0.22 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 7.3 | 0.6 % | ||
| CVE-2026-21279 | ≤ 2023.0.22 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 8.2 | 0.8 % | ||
| CVE-2026-48384 | ≤ 2023.0.22 | ColdFusion | Improper Input Validation (CWE-20) | MEDIUM 4.9 | 1.0 % | ||
| CVE-2026-48375 | ≤ 2023.0.22 | ColdFusion | Incorrect Authorization (CWE-863) | MEDIUM 6.5 | 0.8 % | ||
| CVE-2026-21269 | ≤ 23 | ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 5.4 | 0.6 % | ||
| CVE-2026-48376 | ≤ 2023.0.22 | ColdFusion | Improper Encoding or Escaping of Output (CWE-116) | MEDIUM 5.4 | 0.7 % | ||
| CVE-2026-48440 | ≤ 2023.0.22 | ColdFusion | Heap-based Buffer Overflow (CWE-122) | HIGH 8.1 | 1.3 % | ||
| CVE-2026-34635 | ≤ 2023.0.22 | ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321) | HIGH 8.4 | 0.2 % | ||
| CVE-2026-48386 | ≤ 2023.0.22 | ColdFusion | Use of a Broken or Risky Cryptographic Algorithm (CWE-327) | HIGH 7.5 | 1.0 % | ||
| CVE-2026-48362 | ≤ 2023.0.22 | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | CRITICAL 10.0 | 3.5 % | ||
| CVE-2026-71386 | ≤ 2023.0.22 | ColdFusion | Cross-site Scripting (XSS) (CWE-79) | HIGH 8.8 | 0.5 % | ||
| CVE-2026-71384 | ≤ 2023.0.22 | ColdFusion | Incorrect Authorization (CWE-863) | CRITICAL 9.6 | 0.5 % | ||
| CVE-2026-25652 | ≤ 2023.0.22 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 7.8 | 0.2 % | ||
| CVE-2026-21273 | ≤ 2023.0.22 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 8.7 | 0.9 % | ||
| CVE-2026-48320 | ≤ 21 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) | HIGH 8.5 | 0.4 % | ||
| CVE-2026-48324 | ≤ 21 | ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) | CRITICAL 9.1 | 1.1 % | ||
| CVE-2026-48332 | ≤ 21 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | HIGH 7.7 | 0.8 % | ||
| CVE-2026-48318 | ≤ 21 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | CRITICAL 9.9 | 1.1 % | ||
| CVE-2026-48327 | ≤ 21 | ColdFusion | Incorrect Authorization (CWE-863) | CRITICAL 9.0 | 0.4 % | ||
| CVE-2026-48338 | ≤ 21 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | MEDIUM 6.8 | 0.5 % | ||
| CVE-2026-48329 | ≤ 21 | ColdFusion | Insufficient Session Expiration (CWE-613) | LOW 2.7 | 0.6 % | ||
| CVE-2026-48319 | ≤ 21 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | CRITICAL 9.1 | 1.4 % | ||
| CVE-2026-48321 | ≤ 21 | ColdFusion | Incorrect Authorization (CWE-863) | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-48322 | ≤ 21 | ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) | CRITICAL 9.9 | 1.2 % | ||
| CVE-2026-48284 | ≤ 21 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 9.6 | 0.5 % | ||
| CVE-2026-48328 | ≤ 21 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 7.7 | 0.8 % | ||
| CVE-2026-48325 | ≤ 21 | ColdFusion | Missing Authentication for Critical Function (CWE-306) | CRITICAL 9.3 | 0.6 % | ||
| CVE-2026-48363 | ≤ 20 | ColdFusion | Uncontrolled Search Path Element (CWE-427) | HIGH 8.2 | 0.3 % | ||
| CVE-2026-48364 | ≤ 20 | ColdFusion | Uncontrolled Search Path Element (CWE-427) | HIGH 8.2 | 0.3 % | ||
| CVE-2026-48316 | ≤ 20 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 10.0 | 1.1 % | ||
| CVE-2026-48315 | ≤ 20 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 9.3 | 1.0 % | ||
| CVE-2026-48281 | ≤ 20 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 10.0 | 1.4 % | ||
| CVE-2026-48277 | ≤ 20 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 10.0 | 1.3 % | ||
| CVE-2026-48313 | ≤ 20 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | CRITICAL 9.3 | 3.0 % | ||
| CVE-2026-48285 | ≤ 20 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | HIGH 8.6 | 0.8 % | ||
| CVE-2026-48307 | ≤ 20 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) | HIGH 8.8 | 0.5 % | ||
| CVE-2026-48314 | ≤ 20 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | MEDIUM 6.5 | 0.6 % | ||
| CVE-2026-48282 | ≤ 20 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | CRITICAL 10.0 | 42 % | KEV | |
| CVE-2026-48276 | ≤ 20 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) | CRITICAL 10.0 | 1.3 % | ||
| CVE-2026-48283 | ≤ 20 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) | CRITICAL 10.0 | 1.3 % | ||
| CVE-2026-47932 | ≤ 19 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | HIGH 8.8 | 2.5 % | ||
| CVE-2026-47929 | ≤ 19 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.4 | 2.1 % | ||
| CVE-2026-47960 | ≤ 19 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | HIGH 7.4 | 0.5 % | ||
| CVE-2026-47928 | ≤ 19 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 9.6 | 2.3 % | ||
| CVE-2026-47931 | ≤ 19 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 8.4 | 0.2 % | ||
| CVE-2026-47930 | ≤ 19 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 8.1 | 0.6 % | ||
| CVE-2026-47933 | ≤ 19 | ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-34619 | ≤ 18 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | HIGH 7.7 | 7.6 % | ||
| CVE-2026-27308 | ≤ 18 | ColdFusion | Uncontrolled Resource Consumption (CWE-400) | LOW 2.4 | 2.5 % | ||
| CVE-2026-27305 | ≤ 18 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | HIGH 8.6 | 26 % | ||
| CVE-2026-27282 | ≤ 18 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 7.5 | 0.7 % | ||
| CVE-2026-27304 | ≤ 18 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 9.3 | 3.6 % | ||
| CVE-2026-27306 | ≤ 18 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 8.4 | 0.3 % | ||
| CVE-2026-27307 | ≤ 18 | ColdFusion | Uncontrolled Resource Consumption (CWE-400) | LOW 2.4 | 2.7 % |