CVE-1999-1053

guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".

• http://www.securityfocus.com/archive/1/33674Vendor Advisory
• http://www.securityfocus.com/archive/82/27296Exploit, Vendor Advisory
• http://www.securityfocus.com/archive/82/27560Vendor Advisory
• http://www.securityfocus.com/bid/776Exploit, Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/33674Vendor Advisory
• http://www.securityfocus.com/archive/82/27296Exploit, Vendor Advisory
• http://www.securityfocus.com/archive/82/27560Vendor Advisory
• http://www.securityfocus.com/bid/776Exploit, Patch, Vendor Advisory

Published

Sep 13, 1999

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-1999-1046Buffer overflow in IMonitor in IMail 5.0 allows remote attac…
• CVE-1999-1047When BSDI patches for Gauntlet 5.0 BSDI are installed in a p…
• CVE-1999-1049ARCserve NT agents use weak encryption (XOR) for passwords, …
• CVE-1999-1050Directory traversal vulnerability in Matt Wright FormHandler…
• CVE-1999-1051Default configuration in Matt Wright FormHandler.cgi script …
• CVE-1999-1052Microsoft FrontPage stores form results in a default locatio…
• CVE-1999-1055Microsoft Excel 97 does not warn the user before executing w…
• CVE-1999-1058Buffer overflow in Vermillion FTP Daemon VFTPD 1.23 allows r…
• CVE-1999-1060Buffer overflow in Tetrix TetriNet daemon 1.13.16 allows rem…
• CVE-1999-1063CDomain whois_raw.cgi whois CGI script allows remote attacke…
• CVE-1999-1064Multiple buffer overflows in WindowMaker 0.52 through 0.60.0…
• CVE-1999-1065Palm Pilot HotSync Manager 3.0.4 in Windows 98 allows remote…