Priority MEDIUM 41
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.00505 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-863
Priority LOW 37
ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Security feature bypass.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.01582 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-78
Priority LOW 39
is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00588 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-863
Priority MEDIUM 43
is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00788 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-20
Priority LOW 24
ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.01007 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-20
Priority LOW 30
ColdFusion is affected by an Incorrect Authorization vulnerability that could result in an application denial-of-service.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0081 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-863
Priority LOW 26
is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00679 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-116
Priority MEDIUM 40
ColdFusion is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.01257 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-122
Priority LOW 38
is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass.
CVSS 3.1HIGH 8.4· Local · Low privileges · No interaction · EPSS 0.00246 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-321
Priority MEDIUM 41
ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00961 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-327
Priority MEDIUM 55
ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.03505 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-78
Priority MEDIUM 41
is affected by a Cross-site Scripting (XSS) vulnerability that could result in arbitrary code execution in the context of the current user.
CVSS 3.1HIGH 8.8· Adjacent network · No auth · User interaction · EPSS 0.0055 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-79
Priority MEDIUM 43
is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass.
CVSS 3.1CRITICAL 9.6· Adjacent network · No auth · No interaction · EPSS 0.00457 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-863
Priority LOW 36
is affected by an Incorrect Authorization vulnerability that could result in privilege escalation.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00246 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-863
Priority MEDIUM 41
is affected by an Improper Input Validation vulnerability that could result in privilege escalation.
CVSS 3.1HIGH 8.7· Network · Low privileges · User interaction · EPSS 0.00864 · Published 2026-08-11 · Fixed in 2025.0.12, 2023.0.23 CWE-20
THREATIST.IORead the docs