Adobe ColdFusion

• CVE-2025-30288 High 8.2 ColdFusion | Improper Access Control (CWE-284) 0.3%
• CVE-2025-24446 Critical 9.1 ColdFusion | Improper Input Validation (CWE-20) 1.8%
• CVE-2025-24447 Critical 9.1 ColdFusion | Deserialization of Untrusted Data (CWE-502) 2.2%
• CVE-2025-30281 Critical 9.1 ColdFusion | Improper Access Control (CWE-284) 23.6%
• CVE-2025-30291 Medium 5.5 ColdFusion | Information Exposure (CWE-200) 0.2%
• CVE-2025-30285 High 8.4 ColdFusion | Deserialization of Untrusted Data (CWE-502) 30.9%
• CVE-2025-30286 High 8.4 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) 2.6%
• CVE-2024-53961 High 8.1 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) 14.2%
• CVE-2024-41874 Critical 9.8 ColdFusion | Deserialization of Untrusted Data (CWE-502) 30.3%
• CVE-2024-45113 High 7.5 ColdFusion | Improper Authentication (CWE-287) 0.6%
• CVE-2024-34112 High 7.5 ColdFusion CFDOCUMENT file retrieval / access control bypass 23.7%
• CVE-2024-34113 Medium 5.5 ColdFusion | Weak Cryptography for Passwords (CWE-261) 0.3%
• CVE-2023-44351 Critical 9.8 Adobe ColdFusion RCE Security Vulnerability 50.2%
• CVE-2023-44355 Medium 4.3 ColdFusion | Improper Input Validation (CWE-20) 47.2%
• CVE-2023-26347 High 7.5 CVE-2023-38205 issues | ColdFusion Admin Panel Access 10.1%
• CVE-2023-44352 Medium 6.1 Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version 84.8%
• CVE-2023-44353 Critical 9.8 ColdFusion WDDX Deserialization Gadgets 80.2%
• CVE-2023-44350 Critical 9.8 ColdFusion | Deserialization of Untrusted Data (CWE-502) 64.6%
• CVE-2023-38204 Critical 9.8 Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8 66.9%
• CVE-2023-38206 Medium 5.3 ColdFusion | Improper Access Control (CWE-284) 0.7%
• CVE-2021-40699 High 7.4 ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation 0.6%
• CVE-2021-40698 High 7.4 ColdFusion Use of Inherently Dangerous Function Leads To Security feature bypass   0.6%
• CVE-2023-29301 High 7.5 Adobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypass 34.7%
• CVE-2023-26361 Medium 4.9 Adobe ColdFusion Directory Traversal Arbitrary file system read Vulnerability 58.7%
• CVE-2022-42341 High 7.5 Adobe ColdFusion Improper Restriction of XML External Entity Reference Arbitrary file system read 36.3%
• CVE-2022-38424 High 7.2 Adobe ColdFusion Application Server Directory Traversal Arbitrary file system write 45.8%
• CVE-2022-42340 High 7.5 Adobe ColdFusion Improper Input Validation Arbitrary file system read 34.6%
• CVE-2022-38423 Medium 4.9 Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability 45.7%
• CVE-2022-38422 High 7.5 Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability 44.9%
• CVE-2022-38421 High 7.2 Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability 79.6%
• CVE-2022-38419 High 7.5 Adobe ColdFusion Solr Service XML External Entity Processing Arbitrary file system read 53.7%
• CVE-2022-35711 Critical 9.8 Adobe ColdFusion ODBC Server Heap-based Buffer Overflow Remote Code Execution Vulnerability 74.1%
• CVE-2022-38420 High 7.5 Adobe ColdFusion Use of Hard-coded Credentials Application denial-of-service 44.7%
• CVE-2022-35690 Critical 9.8 Adobe ColdFusion ODBC Agent Stack-based Buffer Overflow Remote Code Execution Vulnerability 72.7%
• CVE-2022-35712 Critical 9.8 Adobe ColdFusion ODBC Agent Heap-based Buffer Overflow Remote Code Execution Vulnerability 37.6%
• CVE-2022-35710 Critical 9.8 Adobe ColdFusion ODBC Server Stack-based Buffer Overflow Remote Code Execution Vulnerability 43.5%
• CVE-2022-38418 Critical 9.8 Adobe ColdFusion Application Server Directory Traversal Remote Code Execution Vulnerability 80.4%
• CVE-2022-28818 Medium 6.1 ColdFusion Reflected Cross-Site Scripting could lead to Arbitrary Code Execution 44.8%
• CVE-2020-10145 High 7.8 The Adobe ColdFusion installer fails to set a secure access-control list (ACL) on the default installation directory, such as C:\ColdFusion2021\. By default, unprivileged users can create files in thi 0.5%
• CVE-2021-21087 Medium 5.4 ColdFusion Improper neutralization of web input during page generation could lead to arbitrary JavaScript execution in the browser 37.1%
• CVE-2020-3796 Unrated ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an improper access control vulnerability. Successful exploitation could lead to system file structure disclosure. 4.3%
• CVE-2020-3768 Unrated ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking vulnerability. Successful exploitation could lead to privilege escalation. 0.9%
• CVE-2020-3767 Unrated ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have an insufficient input validation vulnerability. Successful exploitation could lead to application-level denial-of-service (dos). 3.5%
• CVE-2020-3794 Unrated ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a file inclusion vulnerability. Successful exploitation could lead to arbitrary code execution of files located in the webroot or its subd 7.1%
• CVE-2020-3761 Unrated ColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a remote file read vulnerability. Successful exploitation could lead to arbitrary file read from the coldfusion install directory. 4.2%