CO
App Server
ColdFusion
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
17
On KEV
10.0
Max CVSS
30
New 30D
Severity mix
Critical 81High 99Medium 49Low 5
Watch
Add ColdFusion to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-4941 | 6.1 | May 19 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +14 more |
| CVE-2018-4940 | 6.1 | May 19 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Cross-Site Scripting vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +14 more |
| CVE-2017-11285 | 6.1 | Dec 1 | Adobe ColdFusion has a cross-site scripting (XSS) vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +12 more |
| CVE-2017-3008 | 6.1 | Apr 27 | Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-site scripting vulnerability Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +33 more |
| CVE-2016-4159 | 6.1 | Jun 16 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote attackers to inject arbitrary web… Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +25 more |
| CVE-2016-1113 | 6.1 | May 11 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 allows remote attackers to inject arbitrary web… Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +22 more |
| CVE-2016-1115 | 5.9 | May 11 | Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle… Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +22 more |
| CVE-2025-64897 | 5.6 | Dec 9 | ColdFusion | Improper Access Control (CWE-284) Affected: through 2021.22 |
| CVE-2025-30291 | 5.5 | Apr 8 | ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Information Exposure vulnerability that could result in a security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +27 more |
| CVE-2024-34113 | 5.5 | Jun 13 | ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass Affected: 2021; 2021; 2021; 2021; 2021; 2021; +14 more |
| CVE-2026-21269 | 5.4 | Aug 11 | ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2026-48376 | 5.4 | Aug 11 | ColdFusion | Improper Encoding or Escaping of Output (CWE-116) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2021-21087 | 5.4 | Apr 15 | Adobe Coldfusion versions 2016 (update 16 and earlier), 2018 (update 10 and earlier) and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page… Affected: 2016; 2016; 2016; 2016; 2016; 2016; +23 more |
| CVE-2025-64898 | 5.3 | Dec 9 | ColdFusion | Insufficiently Protected Credentials (CWE-522) Affected: through 2021.22 |
| CVE-2023-38206 | 5.3 | Sep 14 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a… Affected: 2018; 2018; 2018; 2018; 2018; 2018; +24 more |
| CVE-2018-15963 | 5.3 | Sep 25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +17 more |
| CVE-2018-15962 | 5.3 | Sep 25 | Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulnerability Affected: 11.0; 11.0; 11.0; 11.0; 11.0; 11.0; +17 more |
| CVE-2011-0737 | 5.3 | Feb 1 | Adobe ColdFusion 9.0.1 CHF1 and earlier allows remote attackers to obtain sensitive information via an id=- query to a .cfm file, which reveals the installation path in an error… Affected: through 9.0.1; 4.5; 5.0; 6.0; 6.1; 7.0; +7 more |
| CVE-2011-0736 | 5.3 | Feb 1 | Adobe ColdFusion 9.0.1 CHF1 and earlier, when a web application is configured to use a DBMS, allows remote attackers to obtain potentially sensitive information about the database… Affected: through 9.0.1; 4.5; 5.0; 6.0; 6.1; 7.0; +7 more |
| CVE-2025-49542 | 5.2 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2026-48384 | 4.9 | Aug 11 | ColdFusion | Improper Input Validation (CWE-20) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +29 more |
| CVE-2023-26361 | 4.9 | Mar 23 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path… Affected: 2018; 2018; 2018; 2018; 2018; 2018; +16 more |
| CVE-2022-38423 | 4.9 | Oct 14 | Adobe ColdFusion Application Server Directory Traversal Information Disclosure Vulnerability Affected: through CF2021U4; through CF2018u14; through None |
| CVE-2026-47933 | 4.8 | Jun 9 | ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +23 more |
| CVE-2025-49539 | 4.5 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in a… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2025-49543 | 4.3 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2025-49541 | 4.3 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2025-49540 | 4.3 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to… Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2023-44355 | 4.3 | Nov 17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass Affected: before 2021; 2021; 2021; 2021; 2021; 2021; +13 more |
| CVE-2026-48329 | 2.7 | Jul 14 | ColdFusion | Insufficient Session Expiration (CWE-613) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +27 more |
| CVE-2025-54234 | 2.7 | Aug 18 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file system read Affected: 2021; 2021; 2021; 2021; 2021; 2021; +30 more |
| CVE-2026-27308 | 2.4 | Apr 14 | ColdFusion | Uncontrolled Resource Consumption (CWE-400) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more |
| CVE-2026-27307 | 2.4 | Apr 14 | ColdFusion | Uncontrolled Resource Consumption (CWE-400) Affected: 2023; 2023; 2023; 2023; 2023; 2023; +20 more |
| CVE-2025-49546 | 2.4 | Jul 8 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service Affected: 2021; 2021; 2021; 2021; 2021; 2021; +33 more |
| CVE-2015-8053 | – | Nov 18 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 10.0; through 11.0 |
| CVE-2015-8052 | – | Nov 18 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 18 and 11 before Update 7 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 10.0; through 11.0 |
| CVE-2015-5255 | – | Nov 18 | Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before… Affected: through 10.0; through 11.0 |
| CVE-2015-0345 | – | Apr 15 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via… Affected: through 10.0; through 11.0 |
| CVE-2014-9166 | – | Dec 10 | Adobe ColdFusion 10 before Update 15 and 11 before Update 3 allows attackers to cause a denial of service (resource consumption) via unspecified vectors Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +12 more |
| CVE-2014-0572 | – | Oct 15 | Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows local users to bypass intended IP-based… Affected: 9.0; 9.0; 9.0; 9.0.1; 9.0.1; 9.0.1; +12 more |
| CVE-2014-0571 | – | Oct 15 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2… Affected: 9.0; 9.0; 9.0; 9.0.1; 9.0.1; 9.0.1; +12 more |
| CVE-2014-0570 | – | Oct 15 | Cross-site request forgery (CSRF) vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update… Affected: 9.0; 9.0; 9.0; 9.0.1; 9.0.1; 9.0.1; +12 more |
| CVE-2014-5315 | – | Sep 26 | Cross-site scripting (XSS) vulnerability in the Help page in Adobe Acrobat 9.5.2 and earlier and ColdFusion 8.0.1 and earlier allows remote attackers to inject arbitrary web… Affected: through 8.0.1; 8.0 |
| CVE-2013-5328 | – | Nov 13 | Adobe ColdFusion 10 before Update 12 allows remote attackers to read arbitrary files via unspecified vectors Affected: through 10.0; 10.0; 10.0; 10.0; 10.0; 10.0; +1 more |
| CVE-2013-5326 | – | Nov 13 | Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 9.0 before Update 12, 9.0.1 before Update 11, 9.0.2 before Update 6, and 10 before Update 12, when the CFIDE directory… Affected: 9.0; 9.0.1; 9.0.2; through 10.0; 10.0; 10.0; +4 more |
| CVE-2010-5290 | – | Sep 20 | The authentication process in Adobe ColdFusion before 10 does not require knowledge of the cleartext password if the password hash is known, which makes it easier for… Affected: through 9.0.2; 9.0; 9.0.1 |
| CVE-2013-3350 | – | Jul 10 | Adobe ColdFusion 10 before Update 11 allows remote attackers to call ColdFusion Components (CFC) public methods via WebSockets Affected: 10.0; 10.0; 10.0; 10.0; 10.0; 10.0 |
| CVE-2013-3349 | – | Jul 10 | Unspecified vulnerability in Adobe ColdFusion 9.0 through 9.0.2, when the JRun application server is used, allows remote attackers to cause a denial of service via unknown vectors Affected: 9.0; 9.0.1; 9.0.2 |
| CVE-2013-1389 | – | May 16 | Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute… Affected: 9.0; 9.0; 9.0.1; 9.0.1; 9.0.2; 9.0.2; +4 more |
| CVE-2013-3336 | – | May 9 | Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors Affected: 9.0; 9.0.1; 9.0.2; 10.0 |