CVE-2006-6537: IBM WebSphere Host On-Demand

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

IBM WebSphere Host On-Demand 6.0, 7.0, 8.0, 9.0, and possibly 10, allows remote attackers to bypass authentication via a modified pnl parameter, related to hod/HODAdmin.html and hod/frameset.html.

Affected products

• IBM WebSphere Host On-Demand: version 6.0 only; version 7.0 only; version 8.0 only; version 9.0 only

Published 2006-12-14. Last modified 2026-06-16.