Known vulnerabilities in ColdFusion 2021 Update 8 - page 3

Vendor: Adobe
Software: ColdFusion
Version: 2021 Update 8
Software CPE: cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*
Website: https://www.adobe.com
Total vulnerabilities: 103
Public exploits: 1
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting ColdFusion version 2021 Update 8 ColdFusion 2021 Update 8 is affected by 103 vulnerabilities: 9 critical, 22 high, 34 medium, 38 low Critical High Medium Low

Vulnerabilities (103)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU119534 - Insufficiently Protected Credentials
CVE-2025-64898		 CWE-522 Medium
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119532 - Improper Access Control
CVE-2025-64897		 CWE-284 Medium
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119530 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-61823		 CWE-611 Low
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119528 - Improper input validation
CVE-2025-61822		 CWE-20 Low
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119527 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-61821		 CWE-611 High
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119526 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-61813		 CWE-611 High
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119524 - Improper input validation
CVE-2025-61812		 CWE-20 Low
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119522 - Improper Access Control
CVE-2025-61811		 CWE-284 Low
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119505 - Deserialization of Untrusted Data
CVE-2025-61810		 CWE-502 Low
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119504 - Deserialization of Untrusted Data
CVE-2025-61830		 CWE-502 Low
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119503 - Improper input validation
CVE-2025-61809		 CWE-20 Low
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU119502 - Unrestricted Upload of File with Dangerous Type
CVE-2025-61808		 CWE-434 Low
No
No
 2021 Update 23, 2023 Update 17, 2025 Update 5 10.12.2025 SB2025121022
#VU115039 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-54261		 CWE-22 Critical
No
No
 2021 Update 22, 2023 Update 16, 2025 Update 4 09.09.2025 SB2025090965
#VU112608 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49540		 CWE-79 Low
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112607 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-49539		 CWE-611 High
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112606 - XML Injection
CVE-2025-49538		 CWE-91 High
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112605 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-49537		 CWE-78 Medium
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112604 - Incorrect Authorization
CVE-2025-49536		 CWE-863 Medium
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112594 - Use of Hard-coded Credentials
CVE-2025-49551		 CWE-798 High
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112593 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-49535		 CWE-611 High
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955


Showing elements 41 - 60 out of 103