Product
awstats
27 known vulnerabilities across versions
Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.
CVE-2025-63261
CVE-2022-46391
CVE-2020-35176
CVE-2020-29600
CVE-2018-10245
CVE-2017-1000501
CVE-2012-4547
CVE-2010-4369
CVE-2010-4368
CVE-2010-4367
CVE-2009-5020
CVE-2008-5080
CVE-2008-3714
CVE-2006-3682
CVE-2006-3681
CVE-2006-2644
CVE-2006-2237
CVE-2006-1945
CVE-2005-2732
CVE-2005-1527
CVE-2005-0438
CVE-2005-0437
CVE-2005-0436
CVE-2005-0435
CVE-2005-0363
CVE-2005-0362
CVE-2005-0116
all versions
AWStats 8.0 is vulnerable to Command Injection via the open function
>= 7.0 and <= 7.8
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
<= 7.8
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it
<= 7.7
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file i
<= 7.6
A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, ob
<= 7.6.0
Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters re
<= 7.0
Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors.
<= 6.95
Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPl
<= 6.95
awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute ar
<= 6.95
awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary com
<= 6.9
Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites
<= 6.8
awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-si
all versions
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HT
<= 6.5_1.857
awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pl
<= 6.5_1.857
Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to
all versions
AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir param
all versions
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code
<= 6.5_1.857
Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web
<= 6.4
AWStats 6.4, and possibly earlier versions, allows remote attackers to obtain sensitive information via a file that does not exist
<= 6.4
Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to exe
all versions
awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter.
all versions
Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules v
all versions
Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code
all versions
awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode paramet
all versions
awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config par
all versions
awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode",
<= 6.3
AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the