Login Request a demo
AW
Product
Awstats
by Awstats · last CVE Mar 20, 2026
26
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities26In the news0Timeline
Severity mix
Critical 2High 1Medium 3Low 0
Severity
All severities26Critical2High1Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Awstats to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2022-46391
6.1
1%
Dec 4
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks
Affected: 7.0 through 7.8
CVE-2020-35176
5.3
2%
Dec 12
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the…
Affected: through 7.8
CVE-2018-10245
5.3
2%
Apr 20
A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar…
Affected: through 7.6
Showing 3