CVE-2006-3935

system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to (1) send broadcast messages to all users (/workplace/broadcast), (2) list all users (/accounts/users), (3) add webusers (/accounts/webusers/new), (4) upload database import and export files (/database/importhttp), (5) upload arbitrary program modules (/modules/modules_import), and (6) read the log file (/workplace/logfileview) by setting the appropriate value for the path parameter in a direct request to admin-main.jsp.

• http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txtPatch
• http://secunia.com/advisories/21193Patch, Vendor Advisory
• http://securityreason.com/securityalert/1302
• http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zipPatch
• http://www.opencms.org/opencms/en/shownews.html?id=1002Patch
• http://www.securityfocus.com/archive/1/441182/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27996
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28003
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28010
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28026
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28031
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28036
• http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txtPatch
• http://secunia.com/advisories/21193Patch, Vendor Advisory
• http://securityreason.com/securityalert/1302
• http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zipPatch
• http://www.opencms.org/opencms/en/shownews.html?id=1002Patch
• http://www.securityfocus.com/archive/1/441182/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27996
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28003
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28010
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28026
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28031
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28036

Published

Jul 31, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3929Cross-site scripting (XSS) vulnerability in the Forms/rpSysA…
• CVE-2006-3930PHP remote file inclusion vulnerability in admin.a6mambohelp…
• CVE-2006-3931Buffer overflow in the daemon function in midirecord.cc in T…
• CVE-2006-3932SQL injection vulnerability in links.php in Gonafish LinksCa…
• CVE-2006-3933Cross-site scripting (XSS) vulnerability in Alkacon OpenCms …
• CVE-2006-3934Absolute path traversal vulnerability in downloadTrigger.jsp…
• CVE-2006-3936system/workplace/editors/editor.jsp in Alkacon OpenCms befor…
• CVE-2006-3937post.php in x_atrix xGuestBook 1.02 allows remote attackers …
• CVE-2006-3938DotClear allows remote attackers to obtain sensitive informa…
• CVE-2006-3939ScriptsCenter ezUpload Pro 2.2.0 allows remote attackers to …
• CVE-2006-3940Multiple SQL injection vulnerabilities in phpbb-Auction allo…
• CVE-2006-3941Unspecified vulnerability in the daemons for Sun N1 Grid Eng…