AW
Vendor
Awstats
26
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-63261 | AW Awstats Awstats | 7.8 | Mar 20 | AWStats 8.0 is vulnerable to Command Injection via the open function |
| CVE-2022-46391 | AW Awstats Awstats | 6.1 | Dec 4 | AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks |
| CVE-2020-35176 | AW Awstats Awstats | 5.3 | Dec 12 | In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the… |
| CVE-2020-29600 | AW Awstats Awstats | 9.8 | Dec 7 | In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format |
| CVE-2018-10245 | AW Awstats Awstats | 5.3 | Apr 20 | A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar… |
| CVE-2017-1000501 | AW Awstats Awstats | 9.8 | Jan 3 | Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated remote code execution |
| CVE-2010-4369 | AW Awstats Awstats | – | Dec 2 | Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin directory |
| CVE-2010-4368 | AW Awstats Awstats | – | Dec 2 | awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file… |
| CVE-2010-4367 | AW Awstats Awstats | – | Dec 2 | awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on… |
| CVE-2009-5020 | AW Awstats Awstats | – | Dec 2 | Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified… |
| CVE-2008-5080 | AW Awstats Awstats | – | Dec 3 | awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string… |
| CVE-2008-3714 | AW Awstats Awstats | – | Aug 19 | Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a different… |
| CVE-2006-3682 | AW Awstats Awstats | – | Jul 21 | awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month parameters |
| CVE-2006-3681 | AW Awstats Awstats | – | Jul 21 | Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1)… |
| CVE-2006-2644 | AW Awstats Awstats | – | May 30 | AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file… |
| CVE-2006-2237 | AW Awstats Awstats | – | May 8 | The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter |
| CVE-2006-1945 | AW Awstats Awstats | – | Apr 20 | Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter |
| CVE-2005-2732 | AW Awstats Awstats | – | Aug 30 | AWStats 6.4, and possibly earlier versions, allows remote attackers to obtain sensitive information via a file that does not exist in the config parameter, which reveals the path… |
| CVE-2005-1527 | AW Awstats Awstats | – | Aug 15 | Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer,… |
| CVE-2005-0435 | AW Awstats Awstats | – | May 2 | awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog |
| CVE-2005-0438 | AW Awstats Awstats | – | May 2 | awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter |
| CVE-2005-0437 | AW Awstats Awstats | – | May 2 | Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via |
| CVE-2005-0436 | AW Awstats Awstats | – | May 2 | Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter |
| CVE-2005-0363 | AW Awstats Awstats | – | May 2 | awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter |
| CVE-2005-0362 | AW Awstats Awstats | – | Feb 9 | awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "noloadplugin"… |
| CVE-2005-0116 | AW Awstats Awstats | – | Jan 18 | AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats.pl |