CVE-1999-1053: Apache HTTP Server

High severity, CVSS 7.5. EPSS: 85.2% chance of exploitation in the next 30 days.

guestbook.pl cleanses user-inserted SSI commands by removing text between "<!--" and "-->" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".

Affected products

• Apache HTTP Server: version 1.3.9 only
• Matt Wright Matt Wright Guestbook: version 2.3 only

Published 1999-09-13. Last modified 2026-06-16.