Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2018-15961

Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS 9.8 · CriticalBuzz score 63.5KEV listed

Buzz score

Why this CVE is surfacing

Buzz score total 63.5

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 24.0 · diversity 14.5 · KEV 25.0 · OTX 0.0 · PoC 0.0
Mention score
24.0
10 evidence mentions in the snapshot
Diversity score
14.5
5 sources across 2 categories
KEV score
25.0
Known exploited vulnerability present
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
10 source links · newest first
  • Threat Brief: FireEye Red Team Tool BreachUnit42

    Palo Alto Networks commends FireEye for transparency around its reported breach and is working to use the information shared to protect our customers.

    vendorunit42.paloaltonetworks.comDec 11, 2020, 5:10 AM
  • Intelligence Agencies Share Web Shell Detection TechniquesSecurityWeek

    The United Sates National Security Agency (NSA) and the Australian Signals Directorate (ASD) have issued a joint Cybersecurity Information Sheet (CSI) that provides details on vulnerabilities exploited by threat actors to install web shell malware on web servers.

    newswww.securityweek.comApr 26, 2020, 4:46 PM
  • NSA and ASD issue a report warning of web shells deploymentsSecurity Affairs

    A joint report released by the U.S. NSA and the Australian Signals Directorate (ASD) warns of attackers increasingly exploiting vulnerable web servers to deploy web shells. A joint report published by the U.S. National Security Agency (NSA) and the Australian Signals Directorate (ASD) is warning of bad actors increasingly exploiting vulnerable web servers to deploy […]

    newssecurityaffairs.comApr 24, 2020, 10:27 AM
  • Web shell malware continues to evade many security toolsHelp Net Security

    Cyber attackers are increasingly leveraging web shell malware to get persistent access to compromised networks, the US National Security Agency and the Australian Signals Directorate warn. What are web shells? Web shells are malicious scripts that are uploaded to target systems (usually web servers) to enable attackers to control it remotely. In affect, they create a backdoor into the target system. The threat is not limited to internet-facing web servers, though, and can be deployed … More →

    newswww.helpnetsecurity.comApr 23, 2020, 1:50 PM
  • Adobe releases patches to address ColdFusion 0day exploited in the WildSecurity Affairs

    Adobe has released out-of-band updates to address a critical flaw in ColdFusion web application development platform that has been exploited in the wild. Adobe has released out-of-band updates to address a zero-day vulnerability in the ColdFusion web application development platform that has been exploited in the wild. The vulnerability, tracked as CVE-2019-7816, has been described by […]

    newssecurityaffairs.comMar 2, 2019, 8:23 AM
  • Adobe Patches ColdFusion Vulnerability Exploited in the WildSecurityWeek

    Adobe has released out-of-band updates for its ColdFusion web application development platform to address a critical vulnerability that has been exploited in the wild.

    newswww.securityweek.comMar 1, 2019, 7:46 PM
  • Security Affairs newsletter Round 189 – News of the weekSecurity Affairs

    A new round of the weekly SecurityAffairs newsletter arrived! The best news of the week with Security Affairs. Let me inform you that my new book, “Digging in the Deep Web” is online with a special deal 20% discount Kindle Edition Paper Copy Once again thank you! · CVE-2018-15961: Adobe ColdFusion Flaw exploited in attacks in […]

    newssecurityaffairs.comNov 18, 2018, 8:34 AM
  • A week in security (November 5 – 11)Malwarebytes Labs

    Last week on Malwarebytes Labs, we looked at browser lockers that fly under the radar with complete obfuscation, transport and logistics in our…

    newswww.malwarebytes.comNov 11, 2018, 5:00 PM
  • CVE-2018-15961: Adobe ColdFusion Flaw exploited in attacks in the wildSecurity Affairs

    Experts at Volexity discovered that a recently patched remote code execution flaw (CVE-2018-15961) affecting the Adobe ColdFusion has been exploited in the wild. Security experts from Volexity reported that attackers in the wild are exploiting a recently patched remote code execution vulnerability affecting the Adobe ColdFusion. The flaw, tracked as CVE-2018-15961, is an unrestricted file upload vulnerability, successful exploitation could lead to […]

    newssecurityaffairs.comNov 11, 2018, 1:58 PM
  • Adobe ColdFusion Vulnerability Exploited in the WildSecurityWeek

    A recently patched remote code execution vulnerability affecting the Adobe ColdFusion web application development platform has been exploited in the wild by one or more threat groups, Volexity warned on Thursday.

    newswww.securityweek.comNov 9, 2018, 6:16 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-48283

    ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in t…

    CVSS 10.0 · Critical
    13 mentions
  • CVE-2026-48276

    ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in t…

    CVSS 10.0 · Critical
    4 mentions
  • CVE-2025-61808

    ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code executi…

    CVSS 9.1 · Critical
    2 mentions
  • CVE-2019-7838

    ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerability. Successful exploitation could lead…

    CVSS 9.8 · Critical
    1 mention
  • CVE-2019-7816

    ColdFusion versions Update 2 and earlier, Update 9 and earlier, and Update 17 and earlier have a file upload restriction bypass vulnerability. Successful exploitation could lead t…

    CVSS 9.8 · Critical
    2 mentions
  • CVE-2026-16098

    The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSol_handleFileUpload function. This i…

    CVSS 9.8 · Critical
    6 mentions