CVE-2006-0686

add_user.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not check user privileges when adding a new administrative user, which allows remote attackers to gain unauthorized access.

• http://secunia.com/advisories/18799Patch, Vendor Advisory
• http://securityreason.com/securityalert/430
• http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txtVendor Advisory
• http://www.securityfocus.com/archive/1/424816/100/0/threaded
• http://www.securityfocus.com/bid/16600
• http://www.vupen.com/english/advisories/2006/0534
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24667
• http://secunia.com/advisories/18799Patch, Vendor Advisory
• http://securityreason.com/securityalert/430
• http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txtVendor Advisory
• http://www.securityfocus.com/archive/1/424816/100/0/threaded
• http://www.securityfocus.com/bid/16600
• http://www.vupen.com/english/advisories/2006/0534
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24667

Published

Feb 15, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-0680Unspecified vulnerability in WebGUI before 6.8.6-gamma allow…
• CVE-2006-0681Format string vulnerability in powerd.c in Power Daemon (pow…
• CVE-2006-0682Multiple cross-site scripting (XSS) vulnerabilities in bbcod…
• CVE-2006-0683Cross-site scripting (XSS) vulnerability in Virtual Hosting …
• CVE-2006-0684change_password.php in Virtual Hosting Control System (VHCS)…
• CVE-2006-0685The check_login function in login.php in Virtual Hosting Con…
• CVE-2006-0687process.php in DocMGR 0.54.2 does not initialize the $siteMo…
• CVE-2006-0688PHP remote file include vulnerability in application.php in …
• CVE-2006-0689Cross-site scripting (XSS) vulnerability in the Registration…
• CVE-2006-0690Multiple SQL injection vulnerabilities in TTS Time Tracking …
• CVE-2006-0691edituser.php in TTS Time Tracking Software 3.0 does not veri…
• CVE-2006-0692Multiple SQL injection vulnerabilities in Carey Briggs PHP/M…