awstats

25 results · Feed

• High 7.8
  CVE-2025-63261

  AWStats 8.0 is vulnerable to Command Injection via the open function

  awstats awstats Debian Ubuntu
  Mar 20, 2026
• Medium 6.1
  CVE-2022-46391

  AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper ch…

  awstats awstats awstats Debian Ubuntu Alpine
  Dec 4, 2022
• Unscored —
  CVE-2020-35176

  In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), eve…

  awstats awstats awstats Debian Ubuntu Alpine
  Dec 11, 2020
• Unscored —
  CVE-2020-29600

  In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only re…

  awstats awstats awstats Debian Ubuntu Alpine
  Dec 7, 2020
• Unscored —
  CVE-2018-10245

  A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is al…

  awstats awstats Debian Ubuntu
  Apr 20, 2018
• Unscored —
  CVE-2017-1000501

  Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" pa…

  awstats awstats awstats Debian Ubuntu Alpine
  Jan 3, 2018
• Unscored —
  CVE-2012-4547

  Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors.

  awstats Debian
  Oct 31, 2012
• Unscored —
  CVE-2010-4369

  Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a cra…

  awstats Debian
  Dec 2, 2010
• Unscored —
  CVE-2010-4367 Public exploit EPSS 27%

  awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute ar…

  awstats Debian
  Dec 2, 2010
• Unscored —
  CVE-2009-5020

  Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary…

  awstats Debian
  Dec 2, 2010
• Unscored —
  CVE-2008-5080

  awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to condu…

  awstats Debian
  Dec 3, 2008
• Unscored —
  CVE-2008-3714 Public exploit

  Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web s…

  awstats Debian
  Aug 19, 2008
• Unscored —
  CVE-2006-3681

  Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote a…

  awstats Debian
  Jul 18, 2006
• Unscored —
  CVE-2006-3682 Public exploit

  awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) y…

  awstats Debian
  Jul 18, 2006
• Unscored —
  CVE-2006-2644

  AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the conf…

  awstats Debian
  May 30, 2006
• Unscored —
  CVE-2006-2237 Public exploit EPSS 59%

  The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbi…

  awstats Debian
  May 8, 2006
• Unscored —
  CVE-2006-1945 Public exploit

  Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arb…

  awstats Debian
  Apr 20, 2006
• Unscored —
  CVE-2005-1527

  Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attac…

  awstats Debian
  Aug 15, 2005
• Unscored —
  CVE-2005-0363

  awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the…

  awstats Debian
  Feb 16, 2005
• Unscored —
  CVE-2005-0362

  awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pl…

  awstats Debian
  Feb 16, 2005
• Unscored —
  CVE-2005-0436 Public exploit

  Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of…

  awstats Debian
  Feb 15, 2005
• Unscored —
  CVE-2005-0435 Public exploit

  awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginm…

  awstats Debian
  Feb 15, 2005
• Unscored —
  CVE-2005-0438 Public exploit

  awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug paramete…

  awstats Debian
  Feb 15, 2005
• Unscored —
  CVE-2005-0437

  Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Per…

  awstats Debian
  Feb 15, 2005
• Unscored —
  CVE-2005-0116 Public exploit EPSS 75%

  AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharact…

  awstats Debian
  Jan 19, 2005