CVE-2025-24446

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution. Exploitation of this issue does not require user interaction, but admin panel privileges are required, and scope is changed.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-244479.1ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result CVE-2025-244485.5Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensiti CVE-2025-244495.5Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensiti CVE-2025-244507.8Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code e CVE-2025-244517.8Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code e CVE-2025-244527.8InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary c CVE-2025-244537.8InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbit CVE-2025-244568.8In JetBrains Hub before 2024.3.55417 privilege escalation was possible via LDAP authentication mapping CVE-2025-244575.5In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs CVE-2025-244587.8In JetBrains YouTrack before 2024.3.55417 account takeover was possible via spoofed email and Helpdesk integration CVE-2025-244596.1In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page CVE-2025-244604.3In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool