Adobe ColdFusion

• CVE-2024-20767 High 7.4 Exploited ColdFusion | Improper Access Control (CWE-284) 98.5%
• CVE-2023-38205 High 7.5 Exploited ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298 99.8%
• CVE-2023-38203 Critical 9.8 Exploited Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE 97.1%
• CVE-2023-29300 Critical 9.8 Exploited Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution 100.0%
• CVE-2023-29298 High 7.5 Exploited Adobe ColdFusion Improper Access Control Security feature bypass 99.8%
• CVE-2023-26359 Critical 9.8 Exploited Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution 17.0%
• CVE-2023-26360 High 8.6 Exploited Adobe ColdFusion Improper Access Control Arbitrary code execution 97.3%
• CVE-2018-15961 Critical 9.8 Exploited Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbit 100.0%
• CVE-2025-61808 Critical 9.1 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) 10.6%
• CVE-2025-61813 High 7.4 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 0.5%
• CVE-2025-61812 High 8.4 ColdFusion | Improper Input Validation (CWE-20) 4.7%
• CVE-2025-61821 Medium 6.8 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 0.5%
• CVE-2025-64898 Medium 5.3 ColdFusion | Insufficiently Protected Credentials (CWE-522) 0.4%
• CVE-2025-61810 High 8.4 ColdFusion | Deserialization of Untrusted Data (CWE-502) 9.5%
• CVE-2025-61809 Critical 9.1 ColdFusion | Improper Input Validation (CWE-20) 0.7%
• CVE-2025-61822 Medium 6.2 ColdFusion | Improper Input Validation (CWE-20) 0.7%
• CVE-2025-64897 Medium 5.6 ColdFusion | Improper Access Control (CWE-284) 0.1%
• CVE-2025-61823 Medium 6.2 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 0.5%
• CVE-2025-61811 Critical 9.1 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 1.2%
• CVE-2025-54261 Critical 10.0 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 26.5%
• CVE-2025-54234 Low 2.7 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) 0.8%
• CVE-2025-49542 Medium 5.2 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) 1.3%
• CVE-2025-49535 Critical 9.3 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 0.7%
• CVE-2025-49536 High 7.3 ColdFusion | Incorrect Authorization (CWE-863) 0.4%
• CVE-2025-49539 Medium 4.5 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 0.6%
• CVE-2025-49545 Medium 6.2 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) 0.4%
• CVE-2025-49541 Medium 4.3 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) 0.9%
• CVE-2025-49537 High 7.9 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) 2.5%
• CVE-2025-49551 High 8.8 ColdFusion | Use of Hard-coded Credentials (CWE-798) 0.3%
• CVE-2025-49546 Low 2.4 ColdFusion | Improper Access Control (CWE-284) 0.5%
• CVE-2025-49544 Medium 6.8 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) 0.7%
• CVE-2025-49543 Medium 4.3 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) 0.9%
• CVE-2025-49540 Medium 4.3 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) 0.9%
• CVE-2025-49538 High 7.4 ColdFusion | XML Injection (aka Blind XPath Injection) (CWE-91) 2.4%
• CVE-2025-43565 High 8.4 ColdFusion | Incorrect Authorization (CWE-863) 18.4%
• CVE-2025-43559 Critical 9.1 ColdFusion | Improper Input Validation (CWE-20) 1.6%
• CVE-2025-43562 Critical 9.1 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) 51.0%
• CVE-2025-43566 Medium 6.8 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 58.2%
• CVE-2025-43564 Critical 9.1 ColdFusion | Incorrect Authorization (CWE-863) 16.8%
• CVE-2025-43560 Critical 9.1 ColdFusion | Improper Input Validation (CWE-20) 22.6%
• CVE-2025-43563 Critical 9.1 ColdFusion | Improper Access Control (CWE-284) 16.7%
• CVE-2025-43561 Critical 9.1 ColdFusion | Incorrect Authorization (CWE-863) 23.9%
• CVE-2025-30287 High 8.2 ColdFusion | Improper Authentication (CWE-287) 2.9%
• CVE-2025-30293 Medium 6.8 ColdFusion | Improper Input Validation (CWE-20) 0.9%
• CVE-2025-30292 Medium 6.1 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) 15.5%
• CVE-2025-30290 High 8.7 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 19.5%
• CVE-2025-30282 Critical 9.1 ColdFusion | Improper Authentication (CWE-287) 1.8%
• CVE-2025-30284 High 8.4 ColdFusion | Deserialization of Untrusted Data (CWE-502) 2.1%
• CVE-2025-30294 Medium 6.8 ColdFusion | Improper Input Validation (CWE-20) 17.2%
• CVE-2025-30289 High 8.2 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) 5.3%