CVE-2025-43560: falha crítica em Adobe ColdFusion
ColdFusion | Improper Input Validation (CWE-20)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
33Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.1epss 23%
ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Adobe · ColdFusionCVEs relacionadas — Adobe ColdFusion
No mesmo produto, das mais perigosas para as menos.
CVE-2023-29300CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 100.0%KEVCVE-2018-15961CRITICALCVE-2018-15961EPSS 100.0%KEVCVE-2023-29298HIGHAdobe ColdFusion Improper Access Control Security feature bypassEPSS 99.8%KEVCVE-2023-38205HIGHColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298EPSS 99.8%KEVCVE-2024-20767HIGHColdFusion | Improper Access Control (CWE-284)EPSS 98.5%KEVCVE-2023-26360HIGHAdobe ColdFusion Improper Access Control Arbitrary code executionEPSS 97.3%KEV