SilverStripe up to and including 4.3.3 allows a Denial of Service on flush and development URL tools.
silverstripe silverstripe