Unscored severity · published Jul 21, 2006
CVE-2006-3681
Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1)…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
Awstats · Awstats
through 6.5_1.857 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3681
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3681
pridels0.blogspot.com
http://pridels0.blogspot.com/2006/04/awstats-65x-multiple-vuln.html
Exploit
http://secunia.com/advisories/19725
secunia.com
http://secunia.com/advisories/22306
www.ubuntu.com
http://www.ubuntu.com/usn/usn-360-1
www.vupen.com
http://www.vupen.com/english/advisories/2006/1421
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/25879
More from Awstats
9.8
CVE-2020-29600
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format
9.8
CVE-2017-1000501
Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution
7.8
CVE-2025-63261
AWStats 8.0 is vulnerable to Command Injection via the open function
6.1
CVE-2022-46391
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks
5.3
CVE-2020-35176
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the…