CVE-2025-30284— ColdFusion | Deserialization of Untrusted Data (CWE-502)
Quick assessment
Affected
Adobe ColdFusion
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Adobe ColdFusion是美国奥多比（Adobe）公司的一套快速应用程序开发平台。该平台包括集成开发环境和脚本语言。 Adobe ColdFusion 2023.12、2021.18、2025.0及之前版本存在代码问题漏洞，该漏洞源于未信任数据反序列化，可能导致任意代码执行。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-30284
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ColdFusion | Deserialization of Untrusted Data (CWE-502)
Source: CVE Program / CVE List V5
Vulnerability Description
ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security protections and execute code. Exploitation of this issue requires user interaction and scope is changed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
可信数据的反序列化
Source: CVE Program / CVE List V5
Vulnerability Title
Adobe ColdFusion 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Adobe ColdFusion是美国奥多比（Adobe）公司的一套快速应用程序开发平台。该平台包括集成开发环境和脚本语言。 Adobe ColdFusion 2023.12、2021.18、2025.0及之前版本存在代码问题漏洞，该漏洞源于未信任数据反序列化，可能导致任意代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | ColdFusion | 0 ~ 2025.0 | - |
|
II. Public POCs for CVE-2025-30284
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-30284
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-30284 (1)
Same Patch Batch · Adobe · 2025-04-08 · 52 CVEs total
| CVE-2025-30282 | 9.1 CRITICAL | ColdFusion | Improper Authentication (CWE-287) |
| CVE-2025-30281 | 9.1 CRITICAL | ColdFusion | Improper Access Control (CWE-284) |
| CVE-2025-24446 | 9.1 CRITICAL | ColdFusion | Improper Input Validation (CWE-20) |
| CVE-2025-24447 | 9.1 CRITICAL | ColdFusion | Deserialization of Untrusted Data (CWE-502) |
| CVE-2025-30290 | 8.7 HIGH | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' |
| CVE-2025-30286 | 8.4 HIGH | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Comman |
| CVE-2025-30285 | 8.4 HIGH | ColdFusion | Deserialization of Untrusted Data (CWE-502) |
| CVE-2025-30287 | 8.2 HIGH | ColdFusion | Improper Authentication (CWE-287) |
| CVE-2025-30289 | 8.2 HIGH | ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Comman |
| CVE-2025-30288 | 8.2 HIGH | ColdFusion | Improper Access Control (CWE-284) |
| CVE-2025-30295 | 7.8 HIGH | Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) |
| CVE-2025-27195 | 7.8 HIGH | Media Encoder | Heap-based Buffer Overflow (CWE-122) |
| CVE-2025-30299 | 7.8 HIGH | Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) |
| CVE-2025-30296 | 7.8 HIGH | Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191) |
| CVE-2025-30298 | 7.8 HIGH | Adobe Framemaker | Stack-based Buffer Overflow (CWE-121) |
| CVE-2025-27199 | 7.8 HIGH | Animate | Heap-based Buffer Overflow (CWE-122) |
| CVE-2025-27198 | 7.8 HIGH | Photoshop Desktop | Heap-based Buffer Overflow (CWE-122) |
| CVE-2025-27196 | 7.8 HIGH | Premiere Pro | Heap-based Buffer Overflow (CWE-122) |
| CVE-2025-27193 | 7.8 HIGH | Bridge | Heap-based Buffer Overflow (CWE-122) |
| CVE-2025-27200 | 7.8 HIGH | Animate | Use After Free (CWE-416) |
Showing top 20 of 52 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: ColdFusion
-
CVE-2025-61808
ColdFusion | Unrestricted Upload of File with Dangerous Type -
CVE-2025-61813
ColdFusion | Improper Restriction of XML External Entity Ref -
CVE-2025-61812
ColdFusion | Improper Input Validation (CWE-20) -
CVE-2025-64898
ColdFusion | Insufficiently Protected Credentials (CWE-522) -
CVE-2025-61821
ColdFusion | Improper Restriction of XML External Entity Ref
Same vendor: Adobe
-
CVE-2026-84395
Premiere Pro | Server-Side Request Forgery (SSRF) (CWE-918) -
CVE-2026-83963
Substance3D - Modeler | Out-of-bounds Write (CWE-787) -
CVE-2026-81998
Substance3D - Modeler | Out-of-bounds Write (CWE-787) -
CVE-2026-83962
Substance3D - Modeler | Stack-based Buffer Overflow (CWE-121 -
CVE-2026-79906
Substance3D - Modeler | Out-of-bounds Write (CWE-787)
Same weakness: CWE-502
-
CVE-2026-102392
WordPress Extra Product Options For WooCommerce | Custom Pro -
CVE-2026-102377
WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Obje -
CVE-2026-100512
WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injectio -
CVE-2026-97291
WordPress Schema & Structured Data for WP & AMP plugin <= 1. -
CVE-2026-97256
WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP
V. Comments for CVE-2025-30284
No comments yet