Known vulnerabilities in ColdFusion 2025 Update 1 - page 5

Vendor: Adobe
Software: ColdFusion
Version: 2025 Update 1
Software CPE: cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*
Website: https://www.adobe.com
Total vulnerabilities: 96
Public exploits: 1
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting ColdFusion version 2025 Update 1 ColdFusion 2025 Update 1 is affected by 96 vulnerabilities: 7 critical, 23 high, 31 medium, 35 low Critical High Medium Low

Vulnerabilities (96)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU112614 - Improper Access Control
CVE-2025-49546		 CWE-284 Low
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112613 - Server-Side Request Forgery (SSRF)
CVE-2025-49545		 CWE-918 Medium
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112612 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-49544		 CWE-611 Medium
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112609 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49541		 CWE-79 Low
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112611 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49543		 CWE-79 Low
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112608 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49540		 CWE-79 Low
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112607 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-49539		 CWE-611 High
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112606 - XML Injection
CVE-2025-49538		 CWE-91 High
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU109127 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-43566		 CWE-22 Low
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109125 - Improper Access Control
CVE-2025-43565		 CWE-284 Medium
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109124 - Improper Access Control
CVE-2025-43563		 CWE-284 Medium
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109123 - Incorrect Authorization
CVE-2025-43564		 CWE-863 Low
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109122 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-43562		 CWE-78 Low
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109120 - Improper Access Control
CVE-2025-43561		 CWE-284 Medium
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109119 - Improper input validation
CVE-2025-43560		 CWE-20 Low
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109117 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-43559		 CWE-22 High
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117


Showing elements 81 - 100 out of 96