Vulnerability record · CVE-2007-0817 · published 7 February 2007

CVE-2007-0817: Adobe coldfusion vulnerability

Adobe · Coldfusion

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion web server allows remote attackers to inject arbitrary HTML or web script via the User-Agent HTTP header, which is not sanitized before being displayed in an error page.

4.3 CVSS 2.0 Medium EPSS 8.6% · top 5.1%

4.3CVSS 2.0 base score

8.6%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

14References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Coldfusion Adobe

References

Link	Tags
http://osvdb.org/32120
http://secunia.com/advisories/24115
http://www.adobe.com/support/security/bulletins/apsb07-04.html
http://www.securityfocus.com/archive/1/459178/100/0/threaded
http://www.securityfocus.com/bid/22401
http://www.securitytracker.com/id?1017645
http://www.vupen.com/english/advisories/2007/0593
http://osvdb.org/32120
http://secunia.com/advisories/24115
http://www.adobe.com/support/security/bulletins/apsb07-04.html
http://www.securityfocus.com/archive/1/459178/100/0/threaded
http://www.securityfocus.com/bid/22401
http://www.securitytracker.com/id?1017645
http://www.vupen.com/english/advisories/2007/0593

Track CVE-2007-0817 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-48282Adobe ColdFusion path traversal leads to remote code executionColdFusion versions 2025.9, 2023.20 and earlier contain a path traversal flaw (CWE-22) that allows an unauthenticated remote attacker to reach files …KEVEPSS 42%analysed30 Jun 2026 9.8CVE-2023-38203Adobe ColdFusion untrusted data deserialization allows remote code executionAdobe ColdFusion 2018u17, 2021u7, and 2023u1 (and earlier) are affected by a deserialization of untrusted data flaw that can lead to arbitrary code e…KEVEPSS 97%analysed20 Jul 2023 9.8CVE-2023-29300Adobe ColdFusion untrusted data deserialization allows code executionAdobe ColdFusion 2018u16 and earlier, 2021u6 and earlier, and 2023.0.0.330468 and earlier deserialize untrusted data, which can lead to arbitrary cod…KEVEPSS 100%analysed12 Jul 2023 9.8CVE-2023-26359Adobe ColdFusion untrusted data deserialization allows code executionAdobe ColdFusion 2018 Update 15 and earlier and 2021 Update 5 and earlier deserialize untrusted data, which can lead to arbitrary code execution in t…KEVEPSS 17%analysed23 Mar 2023 9.8CVE-2018-15961Adobe ColdFusion unrestricted file upload leads to code executionAdobe ColdFusion (July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier) allows unrestricted file uploads. An uploaded fil…KEVEPSS 100%analysed25 Sep 2018 9.8CVE-2018-4939Adobe ColdFusion Deserialization of Untrusted Data Enables Code ExecutionAdobe ColdFusion Update 5 and earlier and ColdFusion 11 Update 13 and earlier contain a deserialization of untrusted data flaw (CWE-502). A remote, u…KEVEPSS 62%analysed19 May 2018 9.8CVE-2017-3066Adobe ColdFusion Java deserialization in Apache BlazeDS allows RCEAdobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier contain a Java deserializati…KEVEPSS 91%analysed27 Apr 2017 9.8CVE-2013-0632Adobe ColdFusion RDS default password authentication bypassAdobe ColdFusion 9.0 through 10 ships administrator.cfc with an RDS component that accepts a default empty password. An attacker can log in to RDS wi…KEVEPSS 94%analysed17 Jan 2013

Source: NIST National Vulnerability Database (record CVE-2007-0817), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.