CVE-2018-15961
KEVHIGH 10.0EPSS 100.0%
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 99.95% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-11-03
- Nuclei
- critical · CWE-434
- Published
- 2018-09-25
- Updated
- 2025-10-21
Proof-of-concept exploits (8)
- Pocm0n/Web-Coldfusion-Vulnerability-POC3★ · 2022-07-03
- bu1xuan2/CVE-2018-159610★ · 2021-05-21
- byteofandri/CVE-2018-159612★ · 2021-10-03
- byteofjoshua/CVE-2018-159612★ · 2021-10-03
- cved-sources/cve-2018-159611★ · 2021-04-15
- orangmuda/CVE-2018-159612★ · 2021-10-03
- vah13/CVE-2018-159619★ · 2018-12-11
- xbufu/CVE-2018-159613★ · 2021-06-30