Software
awstats
Aggregate across all detected versions
Total Hosts
0
distinct hosts
Versions Seen
0
Countries
0
Known CVEs
27
known CVEs
Top Countries
No geolocated hosts.
Top ASNs
No attributed hosts.
CVE Matches
| CVE | CVSS | Severity | Summary |
|---|---|---|---|
| CVE-2017-1000501 | 9.8 | N/A | Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated rem... |
| CVE-2020-29600 | 9.8 | N/A | In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.con... |
| CVE-2025-63261 | 7.8 | N/A | AWStats 8.0 is vulnerable to Command Injection via the open function |
| CVE-2005-0116 | 7.5 | HIGH | AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtats... |
| CVE-2005-0363 | 7.5 | HIGH | awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter. |
| CVE-2005-0436 | 7.5 | HIGH | Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter. |
| CVE-2005-0437 | 7.5 | HIGH | Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via .. (dot dot) sequences in t... |
| CVE-2010-4367 | 7.5 | HIGH | awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configurat... |
| CVE-2010-4368 | 7.5 | HIGH | awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted... |
| CVE-2010-4369 | 6.4 | MEDIUM | Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin directory. |
| CVE-2022-46391 | 6.1 | N/A | AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks. |
| CVE-2009-5020 | 5.8 | MEDIUM | Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks v... |
| CVE-2018-10245 | 5.3 | N/A | A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the s... |
| CVE-2020-35176 | 5.3 | N/A | In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a f... |
| CVE-2006-2237 | 5.1 | MEDIUM | The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in th... |
| CVE-2005-0435 | 5.0 | MEDIUM | awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog. |
| CVE-2005-0438 | 5.0 | MEDIUM | awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter. |
| CVE-2005-1527 | 5.0 | MEDIUM | Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via t... |
| CVE-2005-2732 | 5.0 | MEDIUM | AWStats 6.4, and possibly earlier versions, allows remote attackers to obtain sensitive information via a file that does not exist in the config parameter, whic... |
| CVE-2006-3682 | 5.0 | MEDIUM | awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month paramete... |
| CVE-2005-0362 | 4.6 | MEDIUM | awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "nolo... |
| CVE-2008-3714 | 4.3 | MEDIUM | Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a dif... |
| CVE-2008-5080 | 4.3 | MEDIUM | awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via... |
| CVE-2012-4547 | 4.3 | MEDIUM | Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors. |
| CVE-2006-2644 | 4.0 | MEDIUM | AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a... |
| CVE-2006-1945 | 2.6 | LOW | Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config... |
| CVE-2006-3681 | 2.6 | LOW | Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script o... |