Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Advisory: Adobe ColdFusion — helpx.adobe.com/security/products/coldfusion/apsb25-52.html Clear all filters
TI-2025-28260 CVE-2025-43565 · GHSA-hf4x-2pvm-qxvv

ColdFusion | Incorrect Authorization (CWE-863)

Priority MEDIUM 56

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution in the context of the current user.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.18402 Published 2025-05-13 No fix listed CWE-863
TI-2025-28254 CVE-2025-43559 · GHSA-rcc5-3vf5-vg86

ColdFusion | Improper Input Validation (CWE-20)

Priority MEDIUM 51

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01643 Published 2025-05-13 No fix listed CWE-20
TI-2025-28257 CVE-2025-43562 · GHSA-9rqc-8g4r-hvhh

ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Priority HIGH 73

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code exe…

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.51028 Published 2025-05-13 No fix listed CWE-78
TI-2025-28261 CVE-2025-43566 · GHSA-5fv4-pxmr-xgp8

ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Priority MEDIUM 64

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.58199 Published 2025-05-13 No fix listed CWE-22
TI-2025-28259 CVE-2025-43564 · GHSA-p54f-88c4-rhqc

ColdFusion | Incorrect Authorization (CWE-863)

Priority MEDIUM 58

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.16835 Published 2025-05-13 No fix listed CWE-863
TI-2025-28255 CVE-2025-43560 · GHSA-4r6r-mmgf-vrgj

ColdFusion | Improper Input Validation (CWE-20)

Priority MEDIUM 61

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.22636 Published 2025-05-13 No fix listed CWE-20
TI-2025-28258 CVE-2025-43563 · GHSA-cg2j-4qw3-47q9

ColdFusion | Improper Access Control (CWE-284)

Priority MEDIUM 58

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.16703 Published 2025-05-13 No fix listed CWE-284
TI-2025-28256 CVE-2025-43561 · GHSA-r75c-5vvp-mrg6

ColdFusion | Incorrect Authorization (CWE-863)

Priority MEDIUM 62

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.2393 Published 2025-05-13 No fix listed CWE-863