ⓘ Adobe ColdFusion


ⓘ Adobe ColdFusion

Adobe ColdFusion is a commercial rapid web-application development platform created by J. J. Allaire in 1995. ColdFusion was originally designed to make it easier to connect simple HTML pages to a database. By version 2, it became a full platform that included an IDE in addition to a full scripting language.


1. Overview

One of the distinguishing features of ColdFusion is its associated scripting language, ColdFusion Markup Language CFML. CFML compares to the scripting components of ASP, JSP, and PHP in purpose and features, but its tag syntax more closely resembles HTML, while its script syntax resembles JavaScript. ColdFusion is often used synonymously with CFML, but there are additional CFML application servers besides ColdFusion, and ColdFusion supports programming languages other than CFML, such as server-side Actionscript and embedded scripts that can be written in a JavaScript-like language known as CFScript.

Originally a product of Allaire and released on July 2, 1995, ColdFusion was developed by brothers Joseph J. Allaire and Jeremy Allaire. In 2001 Allaire was acquired by Macromedia, which in turn was acquired by Adobe Systems Inc in 2005.

ColdFusion is most often used for data-driven websites or intranets, but can also be used to generate remote services such as REST services, WebSockets, SOAP web services or Flash remoting. It is especially well-suited as the server-side technology to the client-side ajax.

ColdFusion can also handle asynchronous events such as SMS and instant messaging via its gateway interface, available in ColdFusion MX 7 Enterprise Edition.


1.1. Overview Main features

ColdFusion provides a number of additional features out of the box. Main features include:

  • Client-side code generation, especially for form widgets and validation
  • Client and server cache management
  • Simplified database access
  • Data retrieval from common enterprise systems such as Active Directory, LDAP, SMTP, POP, HTTP, FTP, Microsoft Exchange Server and common data formats such as RSS and Atom
  • Server, application, client, session, and request scopes
  • GUI administration
  • Conversion from HTML to PDF
  • Simplified file manipulation including raster graphics and CAPTCHA and zip archives introduction of video manipulation is planned in a future release
  • Simplified web service implementation with automated WSDL generation / transparent SOAP handling for both creating and consuming services - as an example, ASP.NET has no native equivalent for < CFINVOKE WEBSERVICE = " METHOD = "Celsius2Fahrenheit" TEMP = "#tempc#" RETURNVARIABLE = "tempf" >
  • XML parsing, querying XPath, validation and transformation XSLT
  • Task scheduling
  • File indexing and searching service based on Apache Solr
  • Server clustering
  • Graphing and reporting

Other implementations of CFML offer similar or enhanced functionality, such as running in a.NET environment or image manipulation.

The engine was written in C and featured, among other things, a built-in scripting language CFScript, plugin modules written in Java, and a syntax very similar to HTML. The equivalent to an HTML element, a ColdFusion tag begins with the letters "CF" followed by a name that is indicative of what the tag is interpreted to, in HTML. E.g. to begin the output of variables or other content.

In addition to CFScript and plugins as described, CFStudio provided a design platform with a WYSIWYG display. In addition to ColdFusion, CFStudio also supports syntax in other languages popular for backend programming, such as Perl. In addition to making backend functionality easily available to the non-programmer, version 4.0 and forward in particular integrated easily with the Apache Web Server and with Internet Information Services.


1.2. Overview Other features

All versions of ColdFusion prior to 6.0 were written using Microsoft Visual C++. This meant that ColdFusion was largely limited to running on Microsoft Windows, although Allaire did successfully port ColdFusion to Sun Solaris starting with version 3.1.

The Allaire company was sold to Macromedia, then Macromedia was sold to Adobe. Earlier versions were not as robust as the versions available from version 4.0 forward.

With the release of ColdFusion MX 6.0, the engine had been re-written in Java and supported its own runtime environment, which was easily replaced through its configuration options with the runtime environment from Sun. Version 6.1 included the ability to code and debug Shockwave Flash.


2. Release history

  • 2013-Apr-10: Adobe ColdFusion 10 Update 9 build
  • 2016-June-14: Adobe ColdFusion 2016 Update 2
  • 2009-October-05: Adobe ColdFusion 9 build
  • 2012-October-16: Adobe ColdFusion 10 Update 3 build
  • 2016-October-7: Adobe ColdFusion 2016 Update 3
  • 2019-June-11: Adobe ColdFusion 2018 Update 4
  • 2018-April-10: Adobe ColdFusion 2016 Update 6
  • 2002-May: Macromedia ColdFusion MX version 6.0 build, Updater 1 build, Updater 2 build, Updater 3 build
  • 2018-September-11: Adobe ColdFusion 2018 Update 1
  • 2007-July-30: Adobe ColdFusion 8 build
  • 1998-November: Allaire ColdFusion version 4.0 space eliminated between Cold and Fusion to make it ColdFusion
  • 2016-February-16: Adobe ColdFusion 2016 release build 2016.0.0.297996
  • 2016-August-30: Adobe ColdFusion 11 Update 10
  • 2012-November-19: Adobe ColdFusion 10 Update 5 build
  • 2014-December-9: Adobe ColdFusion 11 Update 3
  • 2018-April-10: Adobe ColdFusion 11 Update 14
  • 2012-September-11: Adobe ColdFusion 10 Update 2 build
  • 2012-August-31: Adobe ColdFusion 10 Update 1 build
  • 1995-July-02: Allaire Cold Fusion version 1.0
  • 2012-December-11: Adobe ColdFusion 10 Update 6 build
  • 2003-July: Macromedia ColdFusion MX version 6.1 build, hot fix 6.1.0,xxxxx, Updater 1 build
  • 2014-December-9: Adobe ColdFusion 10 Update 15 build
  • 2017-April-25: Adobe ColdFusion 2016 Update 4
  • 2019-December-10: Adobe ColdFusion 2018 Update 7
  • 1998-January: Allaire Cold Fusion version 3.1
  • 2016-June-14: Adobe ColdFusion 11 Update 9
  • 2018-July-12: Adobe ColdFusion 2018 Release 2018.0.0.310739
  • 2012-May-15: Adobe ColdFusion 10 build
  • 2014-October-14: Adobe ColdFusion 10 Update 14
  • 1997-June: Allaire Cold Fusion version 3.0
  • 2013-November-21: Adobe ColdFusion 10 Mandatory Update build 10.283922 - Not needed if you already have Update 8 or later installed.
  • 2015-November-17: Adobe ColdFusion 11 Update 7
  • 2017-April-25: Adobe ColdFusion 11 Update 12
  • 2013-January-15: Adobe ColdFusion 10 Update 7 build
  • 2012-November-02: Adobe ColdFusion 10 Update 4 build
  • 1996: Allaire Cold Fusion version 1.5
  • 2014-September-22: Adobe ColdFusion 11 Update 1
  • 2016-December-20: Adobe ColdFusion 11 Update 11
  • 2016-May-10: Adobe ColdFusion 2016 Update 1
  • 2016-May-10: Adobe ColdFusion 11 Update 8
  • 2005-February-07: Macromedia ColdFusion MX 7 build
  • 2014-January-10: Adobe ColdFusion 10 Update 13 build
  • 2017-September-12: Adobe ColdFusion 2016 Update 5
  • 2001-June: Macromedia ColdFusion version 5.0
  • 2013-July-09: Adobe ColdFusion 10 Update 11 build
  • 2014-April-29: Adobe ColdFusion 11 build
  • 2013-February-27: Adobe ColdFusion 10 Update 8 build
  • 2019-November-20: Adobe ColdFusion 2018 Update 6
  • 2008-April-03: Adobe ColdFusion 8.0.1 build
  • 2019-September-24: Adobe ColdFusion 2018 Update 5
  • 2012-May-31: Adobe ColdFusion 9.0.2 build
  • 2006-June-28: Macromedia ColdFusion MX 7.0.2 build
  • 2013-November-12: Adobe ColdFusion 10 Update 12 build
  • 2013-May-14: Adobe ColdFusion 10 Update 10 build
  • 2010-July-13: Adobe ColdFusion 9.0.1 build
  • 2019-March-1: Adobe ColdFusion 2018 Update 3
  • 1999-November: Allaire ColdFusion version 4.5
  • 2019-February-12: Adobe ColdFusion 2018 Update 2
  • 2014-October-14: Adobe ColdFusion 11 Update 2
  • 2005-September-27: Macromedia ColdFusion MX 7.0.1 build
  • 1996-November: Allaire Cold Fusion version 2.0
  • 2017-September-12: Adobe ColdFusion 11 Update 13


3. Versions

Cold Fusion 3.1

Version 3.1 brought about a port to the Sun Solaris operating system. Cold Fusion studio gained a live page preview and HTML syntax checker.

ColdFusion 4

"Cold Fusion" moniker renamed simply as "ColdFusion" - possibly to distinguish it from Cold fusion theory.

ColdFusion 4.5

Version 4.5 brought the ability to natively invoke Java objects, execute system commands, and talk directly to a Java EE server.


3.1. Versions Cold Fusion 3.1

Version 3.1 brought about a port to the Sun Solaris operating system. Cold Fusion studio gained a live page preview and HTML syntax checker.


3.2. Versions ColdFusion 4

"Cold Fusion" moniker renamed simply as "ColdFusion" - possibly to distinguish it from Cold fusion theory.


3.3. Versions ColdFusion 5

First release from Macromedia after the Allaire Corporation acquisition. The last to be legacy coded for a specific platform.

On January 16, 2001, Allaire announced a pending merger with Macromedia. Macromedia continued its development and released the product under the name ColdFusion 5.0. It retained the name "ColdFusion" through the remainder of version 5 releases.


3.4. Versions ColdFusion MX 6

Prior to 2000, Edwin Smith, an Allaire architect on JRun and later the Flash Player, initiated a project codenamed "Neo". This project was later revealed as a ColdFusion Server re-written completely using Java. This made portability easier and provided a layer of security on the server, because it ran inside a Java Runtime Environment.

In June 2002 Macromedia released the version 6.0 product under a slightly different name, ColdFusion MX, allowing the product to be associated with both the Macromedia brand and its original branding. ColdFusion MX was completely rebuilt from the ground up and was based on the Java EE platform. ColdFusion MX was also designed to integrate well with Macromedia Flash using Flash Remoting.

With the release of ColdFusion MX, the CFML language API was released with an OOP interface.


3.5. Versions ColdFusion MX 7

With the release of ColdFusion 7.0 on February 7, 2005, the naming convention was amended, rendering the product name "Macromedia ColdFusion MX 7" the codename for CFMX7 was "Blackstone". CFMX 7 added Flash-based and XForms-based web forms, and a report builder that output in Adobe PDF as well as FlashPaper, RTF and Excel. The Adobe PDF output is also available as a wrapper to any HTML page, converting that page to a quality printable document. The enterprise edition also added Gateways. These provide interaction with non-HTTP request services such as IM Services, SMS, Directory Watchers, and an asynchronous execution. XML support was boosted in this version to include native schema checking.

ColdFusion MX 7.0.1 codename "Merrimack" added support for Mac OS X, improvements to Flash forms, RTF support for CFReport, the new CFCPRoxy feature for Java/CFC integration, and more. ColdFusion MX 7.0.2 codenamed "Mystic" included advanced features for working with Adobe Flex 2 as well as more improvements for the CF Report Builder.


3.6. Versions Adobe ColdFusion 8

On July 30, 2007, Adobe Systems released ColdFusion 8, dropping "MX" from its name. During beta testing the codename used was "Scorpio" the eighth sign of the zodiac and the eighth iteration of ColdFusion as a commercial product. More than 14.000 developers worldwide were active in the beta process - many more testers than the 5.000 Adobe Systems originally expected. The ColdFusion development team consisted of developers based in Newton/Boston, Massachusetts and offshore in Bangalore, India.

Some of the new features are the CFPDFFORM tag, which enables integration with Adobe Acrobat forms, some image manipulation functions, Microsoft.NET integration, and the CFPRESENTATION tag, which allows the creation of dynamic presentations using Adobe Acrobat Connect, the Web-based collaboration solution formerly known as Macromedia Breeze. In addition, the ColdFusion Administrator for the Enterprise version ships with built-in server monitoring. ColdFusion 8 is available on several operating systems including Linux, Mac OS X and Windows Server 2003.

Other additions to ColdFusion 8 are built-in Ajax widgets, file archive manipulation CFZIP, Microsoft Exchange server integration CFEXCHANGE, image manipulation including automatic CAPTCHA generation CFIMAGE, multi-threading, per-application settings, Atom and RSS feeds, reporting enhancements, stronger encryption libraries, array and structure improvements, improved database interaction, extensive performance improvements, PDF manipulation and merging capabilities CFPDF, interactive debugging, embedded database support with Apache Derby, and a more ECMAScript compliant CFSCRIPT.

For development of ColdFusion applications, several tools are available: primarily Adobe Dreamweaver CS4, Macromedia HomeSite 5.x, CFEclipse, Eclipse and others. "Tag updaters" are available for these applications to update their support for the new ColdFusion 8 features.


3.7. Versions Adobe ColdFusion 9

ColdFusion 9 Codenamed: Centaur was released on October 5, 2009. New features for CF9 include:

  • Tighter integration with Adobe Flex and Adobe AIR.
  • An explicit "local" scope that does not require local variables to be declared at the top of the function.
  • Integration with key Microsoft products including Word, Excel, SharePoint, Exchange, and PowerPoint.
  • Server.cfc file with onServerStart and onServerEnd methods.
  • Ability to code ColdFusion Components CFCs entirely in CFScript.
  • Object-relational mapping ORM Database integration through Hibernate Java.
  • Exposed as Services - an ability to access, securely, functions of the server externally.
  • Implicit getters/setters for CFC.
  • New CFFinally tag for Exception handling syntax and CFContinue tag for Control flow.
  • Implicit constructors via method called "init" or method with same name as CFC.
  • In Memory Management - or Virtual File System: an ability to treat content in memory as opposed to using the HDD.


3.8. Versions Adobe ColdFusion 10

ColdFusion 10 Codenamed: Zeus was released on May 15, 2012. New or improved features available in all editions include but are not limited to:

  • Search integration with Apache Solr
  • Security enhancements
  • HTML5 video player and Adobe Flash Player
  • HTML5 enhancements
  • Tomcat integration
  • Improved web services support WSDL 2.0, SOAP 1.2
  • Support for HTML5 web sockets
  • Hotfix installer and notification
  • XPath integration
  • Improved scheduler based on a version of quartz
  • Language enhancements closures, and more
  • Flex and Adobe AIR lazy loading
  • Support for RESTful web services

Additional new or improved features in ColdFusion Enterprise or Developer editions include but are not limited to:

  • Improved and revamped scheduler additional features over what is added in CF10 Standard
  • Dynamic and interactive HTML5 charting
  • Object relational mapping enhancements

The lists above were obtained from the Adobe web site pages describing "new features", as listed first in the links in the following list.

CF10 was originally referred to by the codename Zeus, after first being confirmed as coming by Adobe at Adobe MAX 2010, and during much of its prerelease period. It was also commonly referred to as "ColdFusion next" and "ColdFusion X" in blogs, on Twitter, etc., before Adobe finally confirmed it would be "ColdFusion 10". For much of 2010, ColdFusion Product Manager Adam Lehman toured the US setting up countless meetings with customers, developers, and user groups to formulate a master blueprint for the next feature set. In September 2010, he presented the plans to Adobe where they were given full support and approval by upper management.

The first public beta of ColdFusion 10 was released via Adobe Labs on 17 February 2012.


3.9. Versions Adobe ColdFusion 11

ColdFusion 11 Codenamed: Splendor was released on April 29, 2014.

New or improved features available in all editions include:

  • REST enhancements
  • WebSocket enhancements
  • Compression enhancements
  • End-to-end mobile development
  • PDF generation enhancements
  • Language enhancements
  • Security enhancements
  • Charting enhancements
  • Social enhancements
  • A new lightweight edition ColdFusion Express

ColdFusion 11 also removed many features previously identified simply as "deprecated" or no longer supported in earlier releases. For example, the CFLOG tag long offered date and time attributes which were deprecated and redundant, as the date and time is always logged. As of CF11, their use would not cause the CFLOG tag to fail.


3.10. Versions Adobe ColdFusion 2016 release

Adobe ColdFusion 2016 release, Codenamed: Raijin and also known generically as ColdFusion 2016 was released on February 16, 2016.

New or improved features available in all editions include:

  • Security enhancements
  • Swagger document generation
  • External session storage Redis
  • PDF generation enhancements
  • NTLM support
  • API Manager
  • Command Line Interface CLI
  • Language enhancements

3.11. Versions Adobe ColdFusion 2018

Adobe ColdFusion 2018 release, known generically as ColdFusion 2018, was released on July 12, 2018. ColdFusion 2018 was codenamed Aether during prerelease.

So far Adobe released 7 updates for ColdFusion 2018.

New or improved features available in all editions include:

  • Auto lockdown capability
  • Command line REPL
  • Language enhancements
  • Modernized Admin UI
  • Distributed cache support
  • Performance Monitoring Toolset
  • Asynchronous programming, using Futures
  • REST playground capability

4. Development roadmap

On August 13, 2012 Adobe announced the new Roadmap for ColdFusion including the code names, "Splendor", "Thunder" and "Dazzle", for the next two release versions. Adobe announced new features for ColdFusion including but not limited to; Mobile - Streamlined Mobile Application Development, Revamped and new PDF functionalities, Enabling Enterprise to easily integrate with Social Media Streams, Enterprise mobility, Support for responsive multi screen content, Digital Marketing – Web, Mobile & Social Analytics and Customizable Enterprise Video Portal. Adobe also announced in the same Roadmap upcoming cloud enhancements. The Roadmap projects ColdFusion development out to the year 2021.


5.1. Features PDF generation

ColdFusion can generate PDF documents using standard HTML i.e. no additional coding is needed to generate documents for print. CFML authors place HTML and CSS within a pair of cfdocument tags or new in ColdFusion 11, cfhtmltopdf tags. The generated document can then either be saved to disk or sent to the clients browser. ColdFusion 8 introduced also the cfpdf tag to allow for control over PDF documents including PDF forms, and merging of PDFs. These tags however do not use Adobes PDF engine but cfdocument uses a combination of the commercial JPedal Java PDF library and the free and open source Java library iText, and cfhtmltopdf uses an embedded WebKit implementation.


5.2. Features ColdFusion Components Objects

ColdFusion was originally not an object-oriented programming language like PHP versions 3 and below. ColdFusion falls into the category of OO languages that do not support multiple inheritance. With the MX release 6+, ColdFusion introduced basic OO functionality with the component language construct which resembles classes in OO languages. Each component may contain any number of properties and methods. One component may also extend another Inheritance. Components only support single inheritance. Object handling feature set and performance enhancing has occurred with subsequent releases. With the release of ColdFusion 8, Java-style interfaces are supported. ColdFusion components use the file extension cfc to differentiate them from ColdFusion templates.cfm.


5.3. Features Remoting

Component methods may be made available as web services with no additional coding and configuration. All that is required is for a methods access to be declared remote. ColdFusion automatically generates a WSDL at the URL for the component in this manner. Aside from SOAP, the services are offered in Flash Remoting binary format.

Methods which are declared remote may also be invoked via an HTTP GET or POST request. Consider the GET request as shown.

This will invoke the components search function, passing "your query" and "strict" as arguments.

This type of invocation is well-suited for Ajax-enabled applications. ColdFusion 8 introduced the ability to serialize ColdFusion data structures to JSON for consumption on the client.

The ColdFusion server will automatically generate documentation for a component if you navigate to its URL and insert the appropriate code within the components declarations. This is an application of component introspection, available to developers of ColdFusion components. Access to a components documentation requires a password. A developer can view the documentation for all components known to the ColdFusion server by navigating to the ColdFusion URL. This interface resembles the Javadoc HTML documentation for Java classes.


5.4. Features Custom Tags

ColdFusion provides several ways to implement custom markup language tags, i.e. those not included in the core ColdFusion language. These are especially useful for providing a familiar interface for web designers and content authors familiar with HTML but not imperative programming.

The traditional and most common way is using CFML. A standard CFML page can be interpreted as a tag, with the tag name corresponding to the file name prefixed with "cf_". For example, the file IMAP.cfm can be used as the tag "cf_imap". Attributes used within the tag are available in the ATTRIBUTES scope of the tag implementation page. CFML pages are accessible in the same directory as the calling page, via a special directory in the ColdFusion web application, or via a CFIMPORT tag in the calling page. The latter method does not necessarily require the "cf_" prefix for the tag name.

A second way is the developments of CFX tags using Java or C++. CFX tags are prefixed with "cfx_", for example "cfx_imap". Tags are added to the ColdFusion runtime environment using the ColdFusion administrator, where JAR or DLL files are registered as custom tags.

Finally, ColdFusion supports JSP tag libraries from the JSP 2.0 language specification. JSP tags are included in CFML pages using the CFIMPORT tag.


6.1. Interactions with other programming languages ColdFusion and Java

The standard ColdFusion installation allows the deployment of ColdFusion as a WAR file or EAR file for deployment to standalone application servers, such as Macromedia JRun, and IBM WebSphere. ColdFusion can also be deployed to servlet containers such as Apache Tomcat and Mortbay Jetty, but because these platforms do not officially support ColdFusion, they leave many of its features inaccessible. As of ColdFusion 10 Macromedia JRun was replaced by Apache Tomcat.

Because ColdFusion is a Java EE application, ColdFusion code can be mixed with Java classes to create a variety of applications and use existing Java libraries. ColdFusion has access to all underlying Java classes, supports JSP custom tag libraries, and can access JSP functions after retrieving the JSP page context GetPageContext.

Prior to ColdFusion 7.0.1, ColdFusion components could only be used by Java or.NET by declaring them as web services. However, beginning in ColdFusion MX 7.0.1, ColdFusion components can now be used directly within Java classes using the CFCProxy class.

Recently, there has been much interest in Java development using alternate languages such as Jython, Groovy and JRuby. ColdFusion was one of the first scripting platforms to allow this style of Java development.


6.2. Interactions with other programming languages ColdFusion and.NET

ColdFusion 8 natively supports.NET within the CFML syntax. ColdFusion developers can simply call any.NET assembly without needing to recompile or alter the assemblies in any way. Data types are automatically translated between ColdFusion and.NET example.NET DataTable → ColdFusion Query.

A unique feature for a Java EE vendor, ColdFusion 8 offers the ability to access.NET Assemblies remotely through proxy without the use of.NET Remoting. This allows ColdFusion users to leverage.NET without having to be installed on a Windows operating system.


7. Acronyms

The acronym for the ColdFusion Markup Language is CFML. When ColdFusion templates are saved to disk, they are traditionally given the extension.cfm or.cfml. The.cfc extension is used for ColdFusion Components. The original extension was DBM or DBML, which stood for Database Markup Language. When talking about ColdFusion, most users use the acronym CF and this is used for numerous ColdFusion resources such as user groups CFUGs and sites.

CFMX is the common abbreviation for ColdFusion versions 6 and 7 a.k.a. ColdFusion MX.


8. Alternative server environments

ColdFusion originated as proprietary technology based on Web technology industry standards. However, it is becoming a less closed technology through the availability of competing products. Such alternative products include in alphabetical order:

  • Coral Web Builder
  • IgniteFusion
  • OpenBD - OpenBD is the worlds first truly open source and free GPL Java CFML runtime.
  • Lucee - Free, open source CFML Engine forked from Railo. Lucees aim is to provide the functionality of CFML using less resources and giving better performance and to move CFML past its roots and into a modern and dynamic web programming platform. Lucee is backed by community supporters and members of the Lucee Association.
  • SmithProject
  • BlueDragon - Proprietary.NET-based CFML Engine and Free Open Source Java-based CFML Engine Open BlueDragon.
  • Railo - Free, Open Source CFML Engine. It comes in three main product editions, and other versions.

The argument can be made that ColdFusion is even less platform-bound than raw Java EE or.NET, simply because ColdFusion will run on top of a.NET app server New Atlanta, or on top of any servlet container or Java EE application server, etc). In theory, a ColdFusion application could be moved unchanged from a Java EE application server to a.NET application server.


9. Vulnerabilities

In March 2013, a known issue affecting ColdFusion 8, 9 and 10 left the National Vulnerability Database open to attack. The vulnerability had been identified and a patch released by Adobe for CF9 and CF10 in January.

In April 2013, a ColdFusion vulnerability was blamed by Linode for an intrusion into the Linode Manager control panel website. A security bulletin and hotfix for this had been issued by Adobe a week earlier.

In May 2013, Adobe identified another critical vulnerability, reportedly already being exploited in the wild, which targets all recent versions of ColdFusion on any servers where the web-based administrator and API have not been locked down. The vulnerability allows unauthorized users to upload malicious scripts and potentially gain full control over the server. A security bulletin and hotfix for this was issued by Adobe 6 days later.

In April 2015, Adobe fixed a cross-site scripting XSS vulnerability in Adobe ColdFusion 10 before Update 16, and in ColdFusion 11 before Update 5, that allowed remote attackers to inject arbitrary web script or HTML; however, its exploitable only by users who have authenticated through the administration panel.

In September 2019, Adobe fixed two command injection vulnerabilities CVE-2019-8073 that enabled arbitrary code and an alleyway traversal CVE-2019-8074.