CVE-2006-4487: DUware DUpoll 3.0 and 3.1 stores _private/Dupoll.mdb under the web document root with insufficient access c...

Security readout for executives and security teams

DUpoll 3.0 and 3.1 may expose its Microsoft Access database from inside the website. If reachable, a remote attacker could download sensitive data, including usernames and passwords. This is an old product issue, but any surviving internet-facing deployment should be treated as urgent to investigate. Exposure is most likely on legacy websites still running DUware DUpoll 3.0 or 3.1 with the database file reachable from the public web root. Modern environments are unlikely to be affected unless this old application was retained or copied into an active site. Prioritize this for any legacy public website using DUpoll because the issue can expose credentials. If no DUpoll deployment exists, no action is needed beyond documenting the inventory result. Treat confirmed exposure as a credential-compromise scenario. Mitigation focus: Inventory websites for DUware DUpoll 3.0 or 3.1.; Check vendor or archived DUware guidance for fixed versions or configuration changes.; Block public web access to _private/Dupoll.mdb if still deployed..

Prepared

Jun 29, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.