Vulnerabilidades do Adobe Coldfusion

ColdFusion is affected by a Missing Authentication for Critical Function vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. Scope is changed.

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

As versões 2025.9, 2023.20 e anteriores do ColdFusion são afetadas por uma vulnerabilidade de Validação Imprópria de Entrada que poderia resultar em execução arbitrária de código no contexto do usuário atual. Um atacante poderia explorar esta vulnerabilidade para injetar scripts maliciosos em uma página web, potencialmente obtendo acesso elevado ou controle sobre a conta ou sessão da vítima. A exploração deste problema requer interação do usuário, pois uma vítima deve abrir um arquivo malicioso. O escopo é alterado.

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

O ColdFusion nas versões 2025.9, 2023.20 e anteriores é afetado por uma vulnerabilidade de Upload Irrestrito de Arquivo com Tipo Perigoso, que pode resultar em execução arbitrária de código no contexto do usuário atual. A exploração dessa falha não requer interação do usuário. O escopo é alterado.

As versões 2025.9, 2023.20 e anteriores do ColdFusion são afetadas por uma vulnerabilidade de Validação de Entrada Inadequada que pode resultar em execução arbitrária de código no contexto do usuário atual. A exploração desse problema não requer interação do usuário. O escopo é alterado.

As versões 2025.9, 2023.20 e anteriores do ColdFusion são afetadas por uma vulnerabilidade de Validação Imprópria de Entrada que pode resultar em execução arbitrária de código no contexto do usuário atual. A exploração desse problema não requer interação do usuário. O escopo é alterado.

As versões 2025.9, 2023.20 e anteriores do ColdFusion são afetadas por uma vulnerabilidade de Upload irrestrito de arquivo com tipo perigoso, que pode resultar em execução arbitrária de código no contexto do usuário atual. A exploração desse problema não requer interação do usuário. O escopo é alterado.

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.