Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

ColdFusion 2025 — Vulnerabilities & Security Advisories 96

All 96 CVE vulnerabilities found in ColdFusion 2025, with AI-generated Chinese analysis, references, and POCs.

This page aggregates Common Weakness Enumeration (CWE) vulnerabilities associated with Adobe ColdFusion 2025. It serves as a comprehensive resource for security researchers and administrators seeking to understand the specific threat landscape surrounding this enterprise application server platform. The content encompasses a wide spectrum of security flaws, including injection attacks, cross-site scripting, server-side request forgery, and improper access control issues that have been identified within the software. This collection covers vulnerability data reported from initial release through recent years, ensuring a historical perspective on the product's security evolution. By consulting this aggregated data, users can effectively track vendor advisories and patch releases issued by Adobe to address critical flaws. Furthermore, individuals can analyze trends related to specific weakness classes to better comprehend the nature of defects in this environment. The page also allows for a detailed lookup of the product’s vulnerability history, providing context on recurring issues and the effectiveness of long-term security fixes. This structured approach facilitates informed decision-making regarding system hardening and upgrade paths. Users interested in the specific technical details of how these weaknesses manifest in ColdFusion 2025 will find relevant categorizations and references here. The goal is to provide a clear, non-promotional overview of known security issues to support proactive defense strategies and compliance monitoring.

Vendor: Adobe

CVE ID Title CVSS Severity Published
CVE-2026-48327 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 9.0 Critical 2026-07-14
CVE-2026-48338 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CWE-22 6.8 Medium 2026-07-14
CVE-2026-48329 ColdFusion | Insufficient Session Expiration (CWE-613) CWE-613 2.7 Low 2026-07-14
CVE-2026-48321 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 9.3 Critical 2026-07-14
CVE-2026-48319 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CWE-22 9.1 Critical 2026-07-14
CVE-2026-48322 ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) CWE-94 9.9 Critical 2026-07-14
CVE-2026-48284 ColdFusion | Improper Input Validation (CWE-20) CWE-20 9.6 Critical 2026-07-14
CVE-2026-48328 ColdFusion | Improper Input Validation (CWE-20) CWE-20 7.7 High 2026-07-14
CVE-2026-48325 ColdFusion | Missing Authentication for Critical Function (CWE-306) CWE-306 9.3 Critical 2026-07-14
CVE-2026-48363 ColdFusion | Uncontrolled Search Path Element (CWE-427) CWE-427 8.2 High 2026-07-13
CVE-2026-48364 ColdFusion | Uncontrolled Search Path Element (CWE-427) CWE-427 8.2 High 2026-07-13
CVE-2026-48316 ColdFusion | Improper Input Validation (CWE-20) CWE-20 10.0 Critical 2026-07-06
CVE-2026-48315 ColdFusion | Improper Input Validation (CWE-20) CWE-20 9.3 Critical 2026-06-30
CVE-2026-48281 ColdFusion | Improper Input Validation (CWE-20) CWE-20 10.0 Critical 2026-06-30
CVE-2026-48277 ColdFusion | Improper Input Validation (CWE-20) CWE-20 10.0 Critical 2026-06-30
CVE-2026-48285 ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) CWE-918 8.6 High 2026-06-30
CVE-2026-48313 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CWE-22 9.3 Critical 2026-06-30
CVE-2026-48307 ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) CWE-79 8.8 High 2026-06-30
CVE-2026-48314 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CWE-22 6.5 Medium 2026-06-30
CVE-2026-48276 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) CWE-434 10.0 Critical 2026-06-30
CVE-2026-48282 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CWE-22 10.0 Critical 2026-06-30
CVE-2026-48283 ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) CWE-434 10.0 Critical 2026-06-30
CVE-2026-47929 ColdFusion | Incorrect Authorization (CWE-863) CWE-863 8.4 High 2026-06-09
CVE-2026-47932 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CWE-22 8.8 High 2026-06-09
CVE-2026-47960 ColdFusion | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) CWE-611 7.4 High 2026-06-09
CVE-2026-47928 ColdFusion | Improper Input Validation (CWE-20) CWE-20 9.6 Critical 2026-06-09
CVE-2026-47931 ColdFusion | Improper Input Validation (CWE-20) CWE-20 8.4 High 2026-06-09
CVE-2026-47930 ColdFusion | Improper Input Validation (CWE-20) CWE-20 8.1 High 2026-06-09
CVE-2026-47933 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79) CWE-79 4.8 Medium 2026-06-09
CVE-2026-34619 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) CWE-22 7.7 High 2026-04-14

All 96 known CVE vulnerabilities affecting ColdFusion 2025 with full Chinese analysis, references, and POCs where available.