Known vulnerabilities in ColdFusion - page 5

Vendor: Adobe
Software: ColdFusion
Software CPE: cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*
Website: https://www.adobe.com
Total vulnerabilities: 226
Public exploits: 12
Known exploited (KEV): 19
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting ColdFusion ColdFusion is affected by 226 known vulnerabilities: 15 critical, 61 high, 70 medium, 80 low Critical High Medium Low

Vulnerabilities (226)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU112614 - Improper Access Control
CVE-2025-49546		 CWE-284 Low
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112613 - Server-Side Request Forgery (SSRF)
CVE-2025-49545		 CWE-918 Medium
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112612 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-49544		 CWE-611 Medium
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112609 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49541		 CWE-79 Low
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112610 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49542		 CWE-79 Low
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112611 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49543		 CWE-79 Low
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112608 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-49540		 CWE-79 Low
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU112607 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-49539		 CWE-611 High
No
No
 2021 Update 21, 2023 Update 15, 2025 Update 3 09.07.2025 SB2025070955
#VU109127 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-43566		 CWE-22 Low
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109125 - Improper Access Control
CVE-2025-43565		 CWE-284 Medium
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109124 - Improper Access Control
CVE-2025-43563		 CWE-284 Medium
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109123 - Incorrect Authorization
CVE-2025-43564		 CWE-863 Low
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109122 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-43562		 CWE-78 Low
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109120 - Improper Access Control
CVE-2025-43561		 CWE-284 Medium
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109119 - Improper input validation
CVE-2025-43560		 CWE-20 Low
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU109117 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-43559		 CWE-22 High
No
No
 2021 Update 20, 2023 Update 14, 2025 Update 2 13.05.2025 SB20250513117
#VU107816 - Deserialization of Untrusted Data
CVE-2025-30285		 CWE-502 Low
No
No
 2021 Update 19, 2023 Update 13, 2025 Update 1 23.04.2025 SB2025042301
#VU107815 - Deserialization of Untrusted Data
CVE-2025-30284		 CWE-502 Low
No
No
 2021 Update 19, 2023 Update 13, 2025 Update 1 23.04.2025 SB2025042301
#VU107814 - Improper Authentication
CVE-2025-30282		 CWE-287 Low
No
No
 2021 Update 19, 2023 Update 13, 2025 Update 1 23.04.2025 SB2025042301
#VU107220 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-24446		 CWE-22 Low
No
No
 2021 Update 19, 2023 Update 13, 2025 Update 1 08.04.2025 SB2025042301


Showing elements 81 - 100 out of 226