What’s Vulnerable › Vulnerabilities
CVE-1999-0477
- Severity: high (CVSS 7.5 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 1999-12-25 · updated 2026-06-16
Description
The Expression Evaluator in the ColdFusion Application Server allows a remote attacker to upload files to the server via openfile.cfm, which does not restrict access to the server properly.
Affected products
- Allaire Coldfusion Server: 2.0, 3.0, 3.01, 3.11, 3.12, 4.0
References
Get alerted when CVE-1999-0477 or the next vulnerability affects your stack