Adobe ColdFusion
110 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-61808 | ≤ 2021.22 | ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) | CRITICAL 9.1 | 11 % | ||
| CVE-2025-61813 | ≤ 2025.4 ; ≤ 2023.16 ; ≤ 2021.22 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | HIGH 7.4 | 0.5 % | ||
| CVE-2025-61812 | ≤ 2021.22 | ColdFusion | Improper Input Validation (CWE-20) | HIGH 8.4 | 4.7 % | ||
| CVE-2025-61821 | ≤ 2021.22 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | MEDIUM 6.8 | 0.5 % | ||
| CVE-2025-64898 | ≤ 2021.22 | ColdFusion | Insufficiently Protected Credentials (CWE-522) | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-61810 | ≤ 2021.22 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | HIGH 8.4 | 9.5 % | ||
| CVE-2025-61809 | ≤ 2021.22 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 9.1 | 0.7 % | ||
| CVE-2025-64897 | ≤ 2021.22 | ColdFusion | Improper Access Control (CWE-284) | MEDIUM 5.6 | 0.1 % | ||
| CVE-2025-61822 | ≤ 2021.22 | ColdFusion | Improper Input Validation (CWE-20) | MEDIUM 6.2 | 0.7 % | ||
| CVE-2025-61823 | ≤ 2021.22 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | MEDIUM 6.2 | 0.5 % | ||
| CVE-2025-61811 | ≤ 2021.22 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | CRITICAL 9.1 | 1.2 % | ||
| CVE-2025-54261 | ≤ 2021.21 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | CRITICAL 10.0 | 25 % | ||
| CVE-2025-54234 | ≤ 2021.19 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | LOW 2.7 | 0.8 % | ||
| CVE-2025-49542 | ≤ 2021.20 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) | MEDIUM 5.2 | 1.3 % | ||
| CVE-2025-49535 | ≤ 2021.20 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | CRITICAL 9.3 | 0.7 % | ||
| CVE-2025-49536 | ≤ 2021.20 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 7.3 | 0.4 % | ||
| CVE-2025-49539 | ≤ 2021.20 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | MEDIUM 4.5 | 0.6 % | ||
| CVE-2025-49545 | ≤ 2021.20 | ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) | MEDIUM 6.2 | 0.4 % | ||
| CVE-2025-49541 | ≤ 2021.20 | ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.3 | 0.9 % | ||
| CVE-2025-49537 | ≤ 2021.20 | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | HIGH 7.9 | 2.5 % | ||
| CVE-2025-49551 | ≤ 2021.20 | ColdFusion | Use of Hard-coded Credentials (CWE-798) | HIGH 8.8 | 0.3 % | ||
| CVE-2025-49546 | ≤ 2021.20 | ColdFusion | Improper Access Control (CWE-284) | LOW 2.4 | 0.5 % | ||
| CVE-2025-49544 | ≤ 2021.20 | ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) | MEDIUM 6.8 | 0.7 % | ||
| CVE-2025-49543 | ≤ 2021.20 | ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.3 | 0.9 % | ||
| CVE-2025-49540 | ≤ 2021.20 | ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) | MEDIUM 4.3 | 0.9 % | ||
| CVE-2025-49538 | ≤ 2021.20 | ColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91) | HIGH 7.4 | 2.4 % | ||
| CVE-2025-43565 | ≤ 2021.19 | ColdFusion | Incorrect Authorization (CWE-863) | HIGH 8.4 | 18 % | ||
| CVE-2025-43559 | ≤ 2021.19 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 9.1 | 1.6 % | ||
| CVE-2025-43566 | ≤ 2021.19 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | MEDIUM 6.8 | 58 % | ||
| CVE-2025-43562 | ≤ 2021.19 | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | CRITICAL 9.1 | 51 % | ||
| CVE-2025-43564 | ≤ 2021.19 | ColdFusion | Incorrect Authorization (CWE-863) | CRITICAL 9.1 | 17 % | ||
| CVE-2025-43560 | ≤ 2021.19 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 9.1 | 23 % | ||
| CVE-2025-43563 | ≤ 2021.19 | ColdFusion | Improper Access Control (CWE-284) | CRITICAL 9.1 | 17 % | ||
| CVE-2025-43561 | ≤ 2021.19 | ColdFusion | Incorrect Authorization (CWE-863) | CRITICAL 9.1 | 24 % | ||
| CVE-2025-30287 | ≤ 2025.0 | ColdFusion | Improper Authentication (CWE-287) | HIGH 8.2 | 2.9 % | ||
| CVE-2025-30293 | ≤ 2025.0 | ColdFusion | Improper Input Validation (CWE-20) | MEDIUM 6.8 | 0.8 % | ||
| CVE-2025-30292 | ≤ 2025.0 | ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) | MEDIUM 6.1 | 16 % | ||
| CVE-2025-30290 | ≤ 2025.0 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | HIGH 8.7 | 20 % | ||
| CVE-2025-30282 | ≤ 2025.0 | ColdFusion | Improper Authentication (CWE-287) | CRITICAL 9.1 | 1.8 % | ||
| CVE-2025-30284 | ≤ 2025.0 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | HIGH 8.4 | 2.1 % | ||
| CVE-2025-30294 | ≤ 2025.0 | ColdFusion | Improper Input Validation (CWE-20) | MEDIUM 6.8 | 17 % | ||
| CVE-2025-30289 | ≤ 2025.0 | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | HIGH 8.2 | 5.3 % | ||
| CVE-2025-30288 | ≤ 2025.0 | ColdFusion | Improper Access Control (CWE-284) | HIGH 8.2 | 0.3 % | ||
| CVE-2025-24446 | ≤ 2025.0 | ColdFusion | Improper Input Validation (CWE-20) | CRITICAL 9.1 | 1.8 % | ||
| CVE-2025-24447 | ≤ 2025.0 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | CRITICAL 9.1 | 2.2 % | ||
| CVE-2025-30281 | ≤ 2025.0 | ColdFusion | Improper Access Control (CWE-284) | CRITICAL 9.1 | 24 % | ||
| CVE-2025-30291 | ≤ 2025.0 | ColdFusion | Information Exposure (CWE-200) | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-30285 | ≤ 2025.0 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | HIGH 8.4 | 31 % | ||
| CVE-2025-30286 | ≤ 2025.0 | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) | HIGH 8.4 | 2.6 % | ||
| CVE-2024-53961 | ≤ 2021.17 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | HIGH 8.1 | 14 % | ||
| CVE-2024-41874 | ≤ 2021.15 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | CRITICAL 9.8 | 30 % | ||
| CVE-2024-45113 | ≤ 2021.12 | ColdFusion | Improper Authentication (CWE-287) | HIGH 7.5 | 0.6 % | ||
| CVE-2024-34113 | ≤ 2021u13 | ColdFusion | Weak Cryptography for Passwords (CWE-261) | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-34112 | ≤ 2021u13 | ColdFusion CFDOCUMENT file retrieval / access control bypass | HIGH 7.5 | 24 % | ||
| CVE-2024-20767 | ≤ 2021.12 | ColdFusion | Improper Access Control (CWE-284) | HIGH 7.4 | 99 % | KEV | |
| CVE-2023-44351 | ≤ 2021.11 | Adobe ColdFusion RCE Security Vulnerability | CRITICAL 9.8 | 50 % | ||
| CVE-2023-44355 | ≤ 2021.11 | ColdFusion | Improper Input Validation (CWE-20) | MEDIUM 4.3 | 47 % | ||
| CVE-2023-26347 | ≤ 2021.11 | CVE-2023-38205 issues | ColdFusion Admin Panel Access | HIGH 7.5 | 10 % | ||
| CVE-2023-44353 | ≤ 2021.11 | ColdFusion WDDX Deserialization Gadgets | CRITICAL 9.8 | 80 % | ||
| CVE-2023-44352 | ≤ 2021.11 | Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version | MEDIUM 6.1 | 85 % | ||
| CVE-2023-44350 | ≤ 2021.11 | ColdFusion | Deserialization of Untrusted Data (CWE-502) | CRITICAL 9.8 | 65 % | ||
| CVE-2023-38204 | ≤ cf2023U2 | Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8 | CRITICAL 9.8 | 67 % | ||
| CVE-2023-38205 | ≤ cf2023U2 | ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298 | HIGH 7.5 | 100 % | KEV | |
| CVE-2023-38206 | ≤ cf2023U2 | ColdFusion | Improper Access Control (CWE-284) | MEDIUM 5.3 | 0.7 % | ||
| CVE-2021-40699 | ≤ 2018.11 | ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation | HIGH 7.4 | 0.5 % | ||
| CVE-2021-40698 | ≤ 2018.11 | ColdFusion Use of Inherently Dangerous Function Leads To Security feature bypass | HIGH 7.4 | 0.6 % | ||
| CVE-2023-38203 | ≤ cf2023U1 | Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE | CRITICAL 9.8 | 97 % | KEV | |
| CVE-2023-29300 | ≤ 2023.0.0.330468 | Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2023-29301 | ≤ 2023.0.0.330468 | Adobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypass | HIGH 7.5 | 35 % | ||
| CVE-2023-29298 | ≤ 2023.0.0.330468 | Adobe ColdFusion Improper Access Control Security feature bypass | HIGH 7.5 | 100 % | KEV | |
| CVE-2023-26361 | unspecified – CF2018U15, CF2021U5 ; unspecified – None | Adobe ColdFusion Directory Traversal Arbitrary file system read Vulnerability | MEDIUM 4.9 | 59 % | ||
| CVE-2023-26360 | unspecified – CF2018U15 ; unspecified – CF2021U5 ; unspecified – None | Adobe ColdFusion Improper Access Control Arbitrary code execution | CRITICAL 9.8 | 97 % | KEV | |
| CVE-2023-26359 | unspecified – CF2018U15, CF2021U5 ; unspecified – None | Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution | CRITICAL 9.8 | 17 % | KEV | |
| CVE-2022-42341 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read | HIGH 7.5 | 36 % | ||
| CVE-2022-42340 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion Improper Input Validation Arbitrary file system read | HIGH 7.5 | 34 % | ||
| CVE-2022-38424 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write | HIGH 7.2 | 46 % | ||
| CVE-2022-38423 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability | MEDIUM 4.9 | 46 % | ||
| CVE-2022-38422 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability | HIGH 7.5 | 45 % | ||
| CVE-2022-38421 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability | HIGH 7.2 | 80 % | ||
| CVE-2022-38420 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service | HIGH 7.5 | 45 % | ||
| CVE-2022-38419 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read | HIGH 7.5 | 54 % | ||
| CVE-2022-35711 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability | CRITICAL 9.8 | 74 % | ||
| CVE-2022-38418 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability | CRITICAL 9.8 | 80 % | ||
| CVE-2022-35712 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability | CRITICAL 9.8 | 37 % | ||
| CVE-2022-35710 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerability | CRITICAL 9.8 | 43 % | ||
| CVE-2022-35690 | unspecified – CF2021U4 ; unspecified – CF2018u14 ; unspecified – None | Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerability | CRITICAL 9.8 | 73 % | ||
| CVE-2022-28818 | unspecified – CF2021U3 ; unspecified – CF2018U13 ; unspecified – None | ColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code Execution | MEDIUM 6.1 | 45 % | ||
| CVE-2020-10145 | 2021 ; 2018 ; 2016 | The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2 | HIGH 7.8 | 0.5 % | ||
| CVE-2021-21087 | unspecified – 2016.16 ; unspecified – 2018.10 ; unspecified – 2021.0.0.323925 ; … | ColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browser | MEDIUM 5.4 | 37 % | ||
| CVE-2020-3796 | ColdFusion 2016, and ColdFusion 2018 versions | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an improper access control vulnerability. Successful exploitation could lead t | MEDIUM 6.5 | 4.3 % | ||
| CVE-2020-3768 | ColdFusion 2016, and ColdFusion 2018 versions | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerability. Successful exploitation could lead | HIGH 7.8 | 0.9 % | ||
| CVE-2020-3767 | ColdFusion 2016, and ColdFusion 2018 versions | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability. Successful exploitation could | MEDIUM 6.5 | 3.5 % | ||
| CVE-2020-3794 | ColdFusion 2016, and ColdFusion 2018 versions | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrar | CRITICAL 9.8 | 7.1 % | ||
| CVE-2020-3761 | ColdFusion 2016, and ColdFusion 2018 versions | ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability. Successful exploitation could lead to arbitr | HIGH 7.5 | 4.2 % | ||
| CVE-2019-8256 | Update 6 and earlier versions | ColdFusion versions Update 6 and earlier have an insecure inherited permissions of default installation directory vulnerability. Successful | CRITICAL 9.8 | 4.0 % | ||
| CVE-2019-7840 | Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier versions | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerab | CRITICAL 9.8 | 17 % | ||
| CVE-2019-7839 | Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier versions | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successfu | CRITICAL 9.8 | 44 % | ||
| CVE-2019-7838 | Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier versions | ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerabil | CRITICAL 9.8 | 17 % | ||
| CVE-2019-7092 | Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier versions | ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a cross site scripting vulnerability. Success | MEDIUM 6.1 | 2.4 % | ||
| CVE-2019-7091 | Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier versions | ColdFusion versions Update 1 and earlier, Update 7 and earlier, and Update 15 and earlier have a deserialization of untrusted data vulnerabi | CRITICAL 9.8 | 26 % | ||
| CVE-2019-7816 | Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier versions | ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerabilit | CRITICAL 9.8 | 68 % | ||
| CVE-2018-15965 | July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru | CRITICAL 9.8 | 26 % | ||
| CVE-2018-15964 | July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with | HIGH 7.5 | 7.9 % | ||
| CVE-2018-15963 | July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerab | MEDIUM 5.3 | 5.7 % | ||
| CVE-2018-15962 | July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulner | MEDIUM 5.3 | 5.5 % | ||
| CVE-2018-15961 | July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file uploa | CRITICAL 9.8 | 100 % | KEV | |
| CVE-2018-15960 | July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with | HIGH 7.5 | 5.5 % | ||
| CVE-2018-15959 | July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru | CRITICAL 9.8 | 26 % | ||
| CVE-2018-15958 | July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru | CRITICAL 9.8 | 26 % | ||
| CVE-2018-15957 | July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier versions | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untru | CRITICAL 9.8 | 28 % |