Threats affecting pkg:maven/com.adobe/coldfusion

ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-34633) that allows a low-privileged attacker to escalate privileges by making unauthorized internal requests. Exploitation does not require user interaction and affects versions up to 2025.0.13 and 2023.0.25. The vulnerability changes the security scope and can lead to high confidentiality impact without affecting integrity or availability.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

Adobe ColdFusion 2025 contains a critical Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-106622) that allows an attacker to escalate privileges without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and can lead to full confidentiality, integrity, and availability compromise.

Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that could allow an attacker to execute arbitrary code with the privileges of the current user. The vulnerability does not require user interaction and affects versions up to 2025.0.13 and 2023.0.25. Exploitation depends on conditions beyond the attacker's control. The vulnerability has a critical severity with a CVSS score of 9.0.

Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue could lead to full compromise of confidentiality, integrity, and availability in the context of the current user.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. Exploitation depends on conditions beyond the attacker's control and results in a changed scope. The issue has a high severity with a CVSS score of 7.8.

Adobe ColdFusion 2025 contains a critical code injection vulnerability (CVE-2026-106624) that allows an attacker to execute arbitrary code without user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue results from improper control of code generation, enabling arbitrary code execution in the context of the current user. The vulnerability has a maximum CVSS score of 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability.

Adobe ColdFusion 2025 contains a critical path traversal vulnerability (CVE-2026-90530) in its Remote Development Services (RDS) feature. This flaw allows an attacker to read arbitrary files on the file system outside the intended restricted directories without requiring user interaction. The vulnerability affects ColdFusion versions up to 2025.0.13 and 2023.0.25. RDS is intended only for development and is disabled when ColdFusion is set to Production Secure Profile. Disabling RDS or running ColdFusion in Production Secure Profile mitigates the risk.

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows an attacker to execute arbitrary code with the privileges of the current user. The vulnerable component is by default restricted to an administrative network zone. Exploitation does not require user interaction and changes the security scope. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The CVSS score is 9.6, indicating critical severity.

Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-34634) that can lead to privilege escalation without requiring user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The scope of the vulnerability is changed, indicating that the impact extends beyond the vulnerable component. The CVSS score is 8.6, reflecting a high severity issue with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, while integrity and availability impacts are none.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to bypass security controls and gain unauthorized write access without user interaction. This vulnerability affects versions up to and including 2025.0.13 and 2023.0.25. The vulnerability changes the security scope and has a critical severity with a CVSS score of 9.6.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe ColdFusion 2025 contains a Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-75748) that allows an attacker with high privileges to escalate access to internal resources without user interaction. The vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue changes the security scope and has a high severity rating with a CVSS score of 7.6.

Adobe ColdFusion 2025 contains an improper input validation vulnerability (CWE-20) that can be exploited to cause an application denial-of-service (DoS). This vulnerability allows an attacker to crash the application without requiring any user interaction. The issue affects versions up to 2025.0.13 and 2023.0.25. The vulnerability has a high severity rating with a CVSS score of 7.5.

Adobe ColdFusion 2025 contains an Incorrect Authorization vulnerability (CWE-863) that may allow an attacker to disclose sensitive memory information without requiring user interaction. This vulnerability affects versions up to 2025.0.13 and 2023.0.25. The issue has a high severity with a CVSS score of 7.5, indicating a significant confidentiality impact but no integrity or availability impact.

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious link. Scope is changed.