AW
Product
Awstats
26
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 1Medium 3Low 0
Watch
Add Awstats to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-29600 | 9.8 | Dec 7 | In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format Affected: through 7.7 |
| CVE-2017-1000501 | 9.8 | Jan 3 | Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution Affected: through 7.6.0 |
| CVE-2025-63261 | 7.8 | Mar 20 | AWStats 8.0 is vulnerable to Command Injection via the open function Affected: 7.9 |
| CVE-2022-46391 | 6.1 | Dec 4 | AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks Affected: 7.0 through 7.8 |
| CVE-2020-35176 | 5.3 | Dec 12 | In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the… Affected: through 7.8 |
| CVE-2018-10245 | 5.3 | Apr 20 | A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar… Affected: through 7.6 |
| CVE-2010-4369 | – | Dec 2 | Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin directory Affected: through 6.95; 1.0; 2.1.; 2.2.3; 2.2.4; 3.0; +28 more |
| CVE-2010-4367 | – | Dec 2 | awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on… Affected: through 6.95; 1.0; 2.1.; 2.2.3; 2.2.4; 3.0; +28 more |
| CVE-2009-5020 | – | Dec 2 | Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified… Affected: through 6.9; 1.0; 2.1.; 2.2.3; 2.2.4; 3.0; +23 more |
| CVE-2010-4368 | – | Dec 2 | awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file… Affected: through 6.95; 1.0; 2.1.; 2.2.3; 2.2.4; 3.0; +28 more |
| CVE-2008-5080 | – | Dec 3 | awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string… Affected: through 6.8; 5.0; 5.1; 5.2; 5.3; 5.4; +13 more |
| CVE-2008-3714 | – | Aug 19 | Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a different… Affected: 6.8 |
| CVE-2006-3682 | – | Jul 21 | awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month parameters Affected: through 6.5_1.857 |
| CVE-2006-3681 | – | Jul 21 | Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1)… Affected: through 6.5_1.857 |
| CVE-2006-2644 | – | May 30 | AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file… Affected: 6.4_1; 6.5; 6.5_1 |
| CVE-2006-2237 | – | May 8 | The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter Affected: 6.4; 6.5 |
| CVE-2006-1945 | – | Apr 20 | Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter Affected: through 6.5_1.857; 6.0; 6.1; 6.2; 6.3; 6.4; +1 more |
| CVE-2005-2732 | – | Aug 30 | AWStats 6.4, and possibly earlier versions, allows remote attackers to obtain sensitive information via a file that does not exist in the config parameter, which reveals the path… Affected: through 6.4 |
| CVE-2005-1527 | – | Aug 15 | Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer,… Affected: through 6.4 |
| CVE-2005-0435 | – | May 2 | awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog Affected: 6.3; 6.4 |
| CVE-2005-0438 | – | May 2 | awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter Affected: 6.3; 6.4 |
| CVE-2005-0437 | – | May 2 | Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via Affected: 6.3; 6.4 |
| CVE-2005-0436 | – | May 2 | Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter Affected: 6.3; 6.4 |
| CVE-2005-0363 | – | May 2 | awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter Affected: 4.0; 6.2 |
| CVE-2005-0362 | – | Feb 9 | awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloadplugin"… Affected: 4.0; 5.0; 5.1; 5.2; 5.3; 5.4; +8 more |
| CVE-2005-0116 | – | Jan 18 | AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl Affected: through 6.3 |
Showing 26