CVE-2025-61810
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result
CVSS
8.4
Alto
EPSS
9.5%
p95
KEV
—
Exploit Today
29
0-100
Publicado: 10 dic 2025 · Última mod.: 25 sept 2026 · CWE-502
9.5%EPSS · 30 días9.5%
2026-09-302026-10-28
ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. A high privileged attacker could exploit this vulnerability by providing maliciously crafted serialized data to the application. Exploitation of this issue requires user interaction and scope is changed.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-621319.8 CRÍ—
———Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.2hCVE-2026-620189.8 CRÍ—
———Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.2hCVE-2026-620179.8 CRÍ—
———Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.2hCVE-2026-620169.8 CRÍ—
———Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.2hCVE-2026-620159.8 CRÍ—
———Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.2hCVE-2026-620149.8 CRÍ—
———Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.2h