CVE-2025-61810: falha de alta gravidade em Adobe ColdFusion
ColdFusion | Deserialization of Untrusted Data (CWE-502)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.4epss 9.5%
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
Adobe · ColdFusionCVEs relacionadas — Adobe ColdFusion
No mesmo produto, das mais perigosas para as menos.
CVE-2023-29300CRITICALAdobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionEPSS 100.0%KEVCVE-2018-15961CRITICALCVE-2018-15961EPSS 100.0%KEVCVE-2023-29298HIGHAdobe ColdFusion Improper Access Control Security feature bypassEPSS 99.8%KEVCVE-2023-38205HIGHColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298EPSS 99.8%KEVCVE-2024-20767HIGHColdFusion | Improper Access Control (CWE-284)EPSS 98.5%KEVCVE-2023-26360HIGHAdobe ColdFusion Improper Access Control Arbitrary code executionEPSS 97.3%KEV