Adobe ColdFusion 2025 Update 3

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:adobe:coldfusion:2025:update3:*:*:*:*:*:*

part: a version: 2025 update: update3

VendorAdobe (fb293c1b-cab3-5565-9184-186e4ece530b)
ProductColdfusion (db90b161-3a2c-5267-99af-6a14e5723f4c)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-21269 vulnerable 2026-09-16 04:34:13.004237 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
MEDIUM (4.6)
ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Published: 2026-08-11T16:31:02.383Z
Updated: 2026-09-08T19:37:43.636Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-48338 vulnerable 2026-07-29 00:55:01.322984 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
MEDIUM (6.8)
ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.
Published: 2026-07-14T21:04:11.745Z
Updated: 2026-08-27T22:39:08.005Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-34619 vulnerable 2026-06-08 07:59:12.810707 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
HIGH (7.7)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction.
Published: 2026-04-14T21:53:59.589Z
Updated: 2026-08-27T22:15:57.643Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27308 vulnerable 2026-06-08 07:53:22.194690 ColdFusion | Uncontrolled Resource Consumption (CWE-400)
LOW (2.4)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
Published: 2026-04-14T21:53:58.735Z
Updated: 2026-08-27T22:15:53.632Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27307 vulnerable 2026-06-08 07:53:22.193021 ColdFusion | Uncontrolled Resource Consumption (CWE-400)
LOW (2.4)
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.
Published: 2026-04-14T21:53:53.899Z
Updated: 2026-08-27T22:15:51.876Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27306 vulnerable 2026-06-08 07:53:22.191071 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27305 vulnerable 2026-06-08 07:53:22.185568 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27304 vulnerable 2026-06-08 07:53:22.183883 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27282 vulnerable 2026-06-08 07:53:22.159385 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-64898 vulnerable 2026-06-08 07:39:20.405769 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-64897 vulnerable 2026-06-08 07:39:20.392952 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61823 vulnerable 2026-06-08 07:37:28.224203 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61822 vulnerable 2026-06-08 07:37:28.220956 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61821 vulnerable 2026-06-08 07:37:28.212309 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61813 vulnerable 2026-06-08 07:37:28.163795 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61812 vulnerable 2026-06-08 07:37:28.160560 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61811 vulnerable 2026-06-08 07:37:28.158061 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61810 vulnerable 2026-06-08 07:37:28.154509 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61809 vulnerable 2026-06-08 07:37:28.146047 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-61808 vulnerable 2026-06-08 07:37:28.141346 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-54261 vulnerable 2026-06-08 07:33:12.071296 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.