The ColdFusion Server versions 4.5 and 5 suffer from multiple vulnerabilities. They range from the default RDS password being blank by default to allowing a normal remote user to reconfigure their website properties to put and get any file on the server.
faa0a31742d24a814cbf24ab9f645633cf615b253c7800154079460c4cdc420b